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Foreword 

This Technical Specification has been produced by the 3GPP. 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of this TS, it will be re-released by the TSG with an identifying 
change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

working draft under the control of the relevant TSG Working Group 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 Indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the specification; 



Introduction 

This specification defines the Universal Subscriber Identity Module (USIM) application. This application resides on the 
UICC, an IC card specified in 3G TS 31.101 [11]. In particular, 3G TS 31.101 [11] specifies the application 
independent properties of the UlCC/terminal interface such as the physical characteristics and the logical structure. 
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1 Scope 

The present document defines the USIM application for 3G telecom network operation. 

The document specifies: 

specific command parameters; 

file structures; 

contents of EFs (Elementary Files); 

security functions; 

application protocol to be used on the interface between UICC (USIM) and ME. 

This is to ensure interoperability between a USIM and an ME independently of the respective manufacturer, card issuer 
or operator. 

This specification does not define any aspects related to the administrative management phase of the USIM. Any 
internal technical realisation of either the USIM or the ME is only specified where these are reflected over the interface. 
This specification does not specify any of the security algorithms which may be used. 

2 References 

The following documents contain provisions which, through reference in this text, constitute provisions of the present 
document. 

• References are either specific (identified by date of publication, edition number, version number, etc.) or 
non-specific. 

• For a specific reference, subsequent revisions do not apply. 

• For a non-specific reference, the latest version applies. 

[ 1 ] 3G TS 2 1 . Ill : "USIM and IC Card Requirements" . 

[2] 3G TS 22.0 11 : "Service accessibiUty" . 

[3] 3G TS 22.024: "Description of Charge Advice Information (CAI)". 

[4] 3G TS 22.030: "Man-Machine Interface (MMI) of the Mobile Station (MS)". 

[5] 3G TS 23.038: "Alphabets and language". 

[6] 3G TS 23.040: "Technical realization of the Short Message Service (SMS) Point-to-Point (PP)". 

[7] 3G TS 23.060 : "General Packet Radio Service (GPRS); Service description; Stage 2". 

[8] 3G TS 23.073: "Support of LocaUsed Service Area (SoLSA)". 

[9] 3G TS 24.008: "Mobile Radio Interface Layer 3 specification". 

[10] 3G TS 24.01 1: "Point-to-Point (PP) Short Message Service (SMS) support on mobile radio 

interface". 

[11] 3G TS 31.101: "UICC -Terminal Interface, Physical and Logical Characteristics". 

[12] 3G TS 31.111: "USIM Application Toolkit (USAT)". 

[13] 3G TS 33.102: "3G Security Architecture". 

[14] 3G TS 33.103: "3G Security; Integration Guidelines". 

[15] 3G TS 22.086: "Advice of charge (AoC) Supplementary Services - Stage 1". 
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[16] 3G TS 23.041: "Technical realization of Short Message Service Cell Broadcast (SMSCB)". 

[17] GSM 02.07: "Mobile Stations (MS) features". 

[18] GSM 1 1 . 1 1 : " Specification of the Subscriber Identity Module - Mobile Equipment (SIM - ME) 

interface". 

[19] ISO 639 (1988): "Code for the representation of names of languages". 

[20] ISO/lEC 7816-4 (1995): "Identification cards - Integrated circuit(s) cards with contacts, Part 4: 

Interindustry commands for interchange". 

[21] ISO/IEC 7816-5 (1994): "Identification cards - Integrated circuit(s) cards with contacts, Part 5: 

Numbering system and registration procedure for application identifiers ". 

[22] ITU-T Recommendation E.164: "Numbering plan for the ISDN era". 

[23] ITU-T Recommendation T.50: "International Alphabet No. 5". (ISO 646: 1983, "Information 

processing - ISO 7-bits coded characters set for information interchange".) 



3 Definitions, symbols and abbreviations 

3.1 Definitions 

For the purposes of the present document, the following terms and definitions apply: 

ADM: Access condition to an EF which is under the control of the authority which creates this file 

3.2 Symbols 

For the purposes of the present document, the following symbols apply: 

II Concatenation 

® Exclusive or 

fl Message authentication function used to compute MAC 

fl * A message authentication code (MAC) function with the property that no valuable information can 

be inferred from the function values of fl* about those of fl, ... , f5 and vice versa. 

f2 Message authentication function used to compute RES and XRES 

D Key generating function used to compute CK 

f4 Key generating function used to compute IK 

f5 Key generating function used to compute AK 

f6 Encryption function to encipher the IMSl 

3.3 Abbreviations 

For the purposes of the present document, the following abbreviations apply: 

3GPP 3'^'' Generation Partnership Project 

AC Access Condition 

ADF Application Dedicated File 

AID Application IDentifier 

AK Anonymity key 

ALW ALWays 

AMF Authentication Management Field 

AoC Advice of Charge 

AuC Authentication Centre 

AUTN Authentication token 

BDN Barred Dialling Number 
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CCP Capability Configuration Parameter 

CK Cipher key 

CS Circuit switched 

DF Dedicated File 

DO Data Object 

EF Elementary File 

EMUI Encrypted Mobile User Identity 

EUIC Enhanced User Identity Confidentiality 

FCI File Control Information 

FFS For Further Study 

GK User group key 

GMSI Group Identity 

GSM Global System for Mobile communications 

HE Home Environment 

ICC Integrated Circuit Card 

ID IDentifier 

IK Integrity key 

IMSI International Mobile Subscriber Identity 

K USIM Individual key 

KSI Key Set Identifier 

Kc Cryptographic key used by the cipher A5 

LSB Least Significant Bit 

MAC Message authentication code 

MAC-A MAC used for authentication and key agreement 

MAC -I MAC used for data integrity of signalling messages 

MCC Mobile Country Code 

MF Master File 

MMI Man Machine Interface 

MNC Mobile Network Code 

MODE Indication packet switched / circuit switched mode 

MSB Most Significant Bit 

NEV NEVer 

NPI Numbering Plan Identifier 

OEM Operational Feature Monitor 

PIN Personal Identification Number 

PS Packet switched 

RAND Random challenge 

RANDms Random challenge stored in the USIM 

RES User response 

RFU Reserved for Future Use 

RST Reset 

SDN Service dialling number 

SE Security Environment 

SFI Short EF Identifier 

SQN Sequence number 

SRES Signed RESponse calculated by a USIM 

SW Status Word 

TLV Tag Length Value 

USAT USIM Application Toolkit 

USIM Universal Subscriber Identity Module 

XRES Expected user RESponse 



4 Contents of the Elementary Files (EF) 

This clause specifies the EFs for the 3G session defining access conditions, data items and coding. A data item is a part 
of an EF which represents a complete logical entity, e.g. the alpha tag in an EFadn record. 

EFs or data items having an unassigned value, or, which during the 3G session, are cleared by the ME, shall have their 
bytes set to 'FF'. After the administrative phase all data items shall have a defined value or have their bytes set to 'FF'. If 
a data item is 'deleted' during a 3G session by the allocation of a value specified in another 3G TS, then this value shall 
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be used, and the data item is not unassigned; e.g. for a deleted LAI in EFloci the last byte takes the value 'FE' 
(3G TS 24.008 [9] refers). 

EFs are mandatory (M) or optional (O). The file size of an optional EF may be zero. All implemented EFs with a file 
size greater than zero shall contain all mandatory data items. Optional data items may either be filled with 'F', or, if 
located at the end of an EF, need not exist. 

When the coding is according to ITU-T Recommendation T.50 [23], bit 8 of every byte shall be set to 0. 

For an overview containing all files see figures 4. 1 and 4.2. 

4.1 Contentsof the EFs at the MF level 

There are three EFs at the Master File (MF) level. These EFs are specified in 3G TS 31.101 [11]. 

4.1.1 EFdir 

This EF contains the Application Identifier (AID) and the Application Label as mandatory elements. 

The USIM application can only be selected by means of the AID selection. The EFdjr entry shall not contain a path 

object for application selection. 

It is recommended that the application label does not contain more than 32 bytes. 

Contents: 

according to 3GTS 31.101 [11]. 
Coding: 

according to 3GTS 31.101 [11]. 

4.1.2 EFicciD (ICC Identity) 

This EF provides a unique identification number for the ICC. 

Contents: 

according to 3GTS 31.101 [11]. 
Coding: 

according to 3GTS 31.101 [11]. 

4.1 .3 EFpL (Preferred Languages) 

This EF contains the codes for up to n languages. This information, determined by the user/operator, defines the 
preferred languages of the user in order of priority. 

Contents: 

according to 3GTS 31.101 [11]. 
Coding: 

according to 3GTS 31.101 [11]. 

4.2 Contents of files at the USIM ADF (Application DF) level 

The EFs in the USIM ADF contain service and network related information. 

4.2.1 EFli (Language Indication) 

This EF contains the codes for one or more languages. This information, determined by the user/operator, defines the 
preferred languages of the user in order of priority. This information may be used by the ME for MMI purposes and for 
short message handling (e.g. screening of preferred languages in SMS-CB). 
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Identifier: '6F 05' Structure: transparent Optional 


File size: 2n bytes Update activity: low 


Access Conditions: 

READ ALW 
UPDATE PIN 
DEACTIVATEDEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 2 


1"^' language code (highest prior.) 


M 


2 bytes 


3 to 4 


2"° language code 





2 bytes 










2n-1 to 2n 


Nth language code (lowest prior.) 





2 bytes 



Coding: 

each language code is a pair of alpha-numeric characters, defined in ISO 639 [19]. Each alpha-numeric 
character shall be coded on one byte using the SMS default 7-bit coded alphabet as defined in 3G TS 23.038 
[5] with bit 8 set to 0. 

Unused language entries shall be set to 'FF FF'. 

4.2.2 EFiMsi (IMSI) 

This EF contains the International Mobile Subscriber Identity (IMSI). 



Identifier: '6F07' Structure: transparent Mandatory 


SFI: '07' 




File size: 9 bytes 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Length of IMSI 


M 


1 byte 


2-9 


IMSI 


M 


8 bytes 



Length of IMSI 
Contents: 

the length indicator refers to the number of significant bytes, not including this length byte, required for the 

IMSI. 
Coding: 

according to 3G TS 24.008 [9]. 

IMSI 
Contents: 

International Mobile Subscriber Identity. 
Coding: 

this information element is of variable length. If a network operator chooses an IMSI of less than 15 digits, 

unused nibbles shall be set to 'F'. 
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Byte 2: 



b8 


b7 


b6 


B5 


b4 


b3 


b2 


bl 


1 




Digit 
Digit 
































L 



























Parity 
















LSB of 


1 


























































MSB of 


1 



For the parity bit, see 3G TS 24.008 [9]. 
Byte 3: 



b7 



b6 



b4 



b3 



b2 



bl 



LSB of Digit 2 



MSB of Digit 2 
LSB of Digit 3 



MSB of Digit 3 



etc. 



4.2.3 EpKeys (Ciphering and Integrity Keys) 

This EF contains the ciphering key CK, the integrity key IK and the key set identifier KSI. 



Identifier: '6F08' 




Structure 


transparent 


Mandatory 


SFI: '08' 




File size: 33 bytes 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Key set identifier KSI 


M 


1 byte 


2to17 


Ciphering key CK 


M 


1 6 bytes 


18to33 


Integrity key IK 


M 


16 bytes 



Key Set Identifier KSI 
Coding: 



b8 


b7 


b6 


B5 


b4 


b3 


b2 


bl 














1 


1 


1 


1 


KSI 












bits b5 to b8 are coded 



Ciphering key CK 
Coding: 

the least significant bit of CK is the least significant bit of the 17* byte. The most significant bit of CK is the 

most significant bit of the 2"'' byte. 

Integrity key IK 
Coding: 

the least significant bit of IK is the least significant bit of the 33'^'' byte. The most significant bit of IK is the 

most significant bit of the 18* byte. 
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4.2.4 EpKeysPs (Ciphering and Integrity Keys for Pacl^et Switclned domain) 

This EF contains the ciphering key CKPS, the integrity key IKPS and the key set identifier KSIPS for the packet 
switched (PS) domain. 



Identifier: '6F09' 


Structure 


transparent 




Optional 


SFI: '09' 




File size: 33 bytes 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 


Key set identifier KSIPS 


M 


1 byte 


2to17 


Cipliering l<ey CKPS 


M 


1 6 bytes 


18to33 


Integrity Key IKPS 


M 


16 bytes 



Key Set Identifier KSIPS 
Coding: 



b8 


b7 


b6 


B5 


b4 


b3 


b2 


bl 














1 1 1 1 





















KSIPS 

bits b5 to b8 are coded 



- Ciphering key CKPS 
Coding: 

the least significant bit of CKPS is the least significant bit of the 17* byte. The most significant bit of CKPS 
is the most significant bit of the 2""* byte. 

- Integrity key IKPS 
Coding: 

the least significant bit of IKPS is the least significant bit of the SS"^"* byte. The most significant bit of IKPS is 
the most significant bit of the 18* byte. 

4.2.5 EFpLMNsei (PLMN selector) 

This EF contains the coding for n PLMNs, where n is at least eight. This information determined by the user/operator 
defines the preferred PLMNs of the user in priority order. 



Identifier: '6F30' Structure: transparent 


Optional 


File size: 3n (n >= 8) bytes Update activity 


: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1-3 


1"PLMN (highest priority) 


M 


3 bytes 










22 to 24 


8'" PLMN 


M 


3 bytes 


25 to 27 


9'" PLMN 





3 bytes 










{3n-2)-3n 


Nth PLMN (lowest priority) 





3 bytes 



PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 
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according to 3G TS 24.008 [9]; 

if storage for fewer than the maximum possible number n is required, the excess bytes shall be set to 'FF'. 
for instance, using 246 for the MCC and 8 1 for the MNC and if this is the first and only PLMN, the contents 
reads as follows: 

Bytes 1-3: '42' 'F6' '18' 

Bytes 4-6: 'FF' 'FF' 'FF' 

etc. 

4.2.6 EFhplmn (HPLMN search period) 

This EF contains the interval of time between searches for the HPLMN (see 3G TS 22.01 1 [2]). 



Identifier: '6F31' 


Structure 


transparent Mandatory 


File size: 1 


byte 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 


Time interval 


M 


1 byte 



Time interval 
Contents: 

the time interval between two searches. 
Coding: 

the time interval is coded in integer multiples of n minutes. The range is from n minutes to a maximum value. 

The value '00' indicates that no attempts shall be made to search for the HPLMN. The encoding is: 



'00' 
'01' 
'02' 



No HPLMN search attempts; 
n minutes; 
2n minutes; 



'YZ': (16YH-Z)n minutes (maximum value). 
All other values shall be interpreted by the ME as a default period. 
For specification of the integer timer interval n, the maximum value and the default period refer to 3G TS 22.0 11 [2]. 



4.2.7 EpACMmax (ACM maximum value) 



This EF contains the maximum value of the accumulated call meter. This EF shall always be allocated if EFacm is 
allocated. 



Identifier: '6F37' 


Structure: transparent Optional 


File size: 3 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 

DEACTIVATE 
ACTIVATE 




PIN 

PIN/PIN2 

(fixed during administrative management) 

ADM 

ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Maximum 


value 




M 


3 bytes 
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Maximum value 
Contents: 

maximum value of the Accumulated Call Meter (ACM). 
Coding: 

First byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



Second byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



,15 ,14 ,13 ,12 ,11 ,10 



Third byte: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 

2^ 


1 
26 


1 
25 


1 
2^ 


1 

23 


1 
22 


1 
2I 


1 
2O 



For instance, '00' '00' '30' represents 2^+24. 

All ACM data is stored in the USIM and transmitted over the USIM/ME interface as binary. 

ACMmax is not vaHd, as defined in 3G TS 22.024 [3], if it is coded '000000'. 

If a GSM application is present on the UICC and the ACMmax value is to be shared between the GSM and the USIM 
application this file shall be shared between the two applications. 

4.2.8 EFusT (USIM Service Table) 

This EF indicates which services are available. If a service is not indicated as available in the USIM, the ME shall not 
select this service. 



Identifier: '6F38' Structure: transparent Mandatory 


File size: X bytes, X >= 2 Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Services n°1 to n°8 


M 


1 byte 


2 


Services n°9 to n°16 





1 byte 


3 


Services n°17to n°24 





1 byte 


4 


Services n° 25 to n°32 





1 byte 


etc. 








X 


Services n°(4X-3) to n°(4X) 





1 byte 
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-Services 
Contents: 



Service n°1 
Service n°2 
Service n°3 
Service n °4 
Service n°5 
Service n°6 
Service n"7 
Service n°8 
Service n°9 
Service n°10 
Service n 
Service n 
Service n 
Service n 
Service n 
Service n 
Service n 
Service n 
Service n 
Service n°20 
Service n°21 
Service n°22 
Service n°23 
Service n'=24 
Service n°25 
Service n°26 
Service n°27 
Service n °28 
Service n '=29 
Service n°30 
Service n°31 
Service n°32 
Service n °33 



°11 

°13 

°15 
°16 
"M 
°18 
°19 



Local Ptione Bool< 

Fixed Dialling Numbers (FDN): FFS 

Extension 2 

Service Dialling Numbers (SDN) 

Extensions 

Barred Dialling Numbers (BDN): FFS 

Extension4 

Outgoing Call Information (OCI and OCT) 

Incoming Call Information (ICI and ICT) 

Short Message Storage (SIVIS) 

Short Message Status Reports (SMSR) 

Short Message Service Parameters (SMSP) 

Advice of Charge (AoC) 

Capability Configuration Parameters (CCP) 

Cell Broadcast Message Identifier 

Cell Broadcast Message Identifier Ranges 

Group Identifier Level 1 

Group Identifier Level 2 

Service Provider Name 

PLMN selector 

MSISDN 

Image (IMG) 

SoLSA (Support of Local Service Area) 

Enhanced Multi-Level Precedence and Pre-emption Service 

Automatic Answer for Emipp 

EUlC (Enhanced User Identity Confidentiality) 

2G Access 

Data download via SMS-PP 

Data download via SMS-CB 

Call Control by USIM 

MO-SMS Control by USIM 

RUN AT COMMAND command 

Packet Switched Domain 



The EF shall contain at least one byte. Further bytes may be included, but if the EF includes an optional byte, then it is 
mandatory for the EF to also contain all bytes before that byte. Other services are possible in the future and will be 
coded on further bytes in the EF. The coding falls under the responsibility of 3G. 

Coding: 

1 bit is used to code each service: 
bit = 1 : service available; 
bit = 0: service not available. 



Service available means that the USIM has the capability to support the service and that the service is 
available for the user of the USIM. 

Service not available means that the service shall not be used by the USIM user, even if the USIM has the 
capability to support the service. 

First byte: 



b7 



b6 



b4 



b3 



b2 



bl 



Service n°l 
Service n°2 
Service n°3 
Service n°4 
Service n°5 
Service n°6 
Service n°7 
Service n°8 
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Second byte: 



b8 b7 b6 



b4 b3 b2 bl 



Service n°9 

Service n°10 

Service n°ll 

Service n°12 

Service n°13 

Service n°14 

Service n°15 

Service n°16 



etc. 

If the USIM supports the BDN feature (BDN available) and the ME does not support the BDN feature it shall stop 
operation immediately. 

4.2.9 EFacm (Accumulated Call Meter) 

This EF contains the total number of units for both the current call and the preceding calls. 

NOTE: The information may be used to provide an indication to the user for advice or as a basis for the 
calculation of the monetary cost of calls (see 3G TS 22.086 [15]). 



Identifier: '6F39' Structure: cyclic Optional 


SFI: Recommended 




Record length: 3 bytes 


Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN/PIN2 

(fixed during administrative management) 
INCREASE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Accumulated count of units 


M 


3 bytes 



Accumulated count of units 
Contents: 

value of the ACM. 
Coding: 

see the coding of EpACMmax- 

If a GSM application is present on the UICC and the ACM value is to be shared between the GSM and the USIM 
application this file shall be shared between the two applications. 



4.2. 1 EFgidi (Group Identifier Level 1 ) 



This EF contains identifiers for particular USIM-ME associations. It can be used to identify a group of USIMs for a 
particular application. 



Identifier: '6F3E' Structure: transparent Optional 


File size: 1 -n bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -n 


USIM group identifier(s) 





n bytes 
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4.2. 11 EFgid2 (Group Identifier Level 2) 



This EF contains identifiers for particular USIM-ME associations. It can be used to identify a group of USIMs for a 
particular application. 



Identifier: '6F3F' 


Structure 


transparent 


Optional 


File size: 1-n 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 






PIN 

ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -n 


USIM group 


identifier(s) 







n bytes 



NOTE: The structure of EFgidi and EFgid2 is identical. They are provided to allow the network operator to 
enforce different levels of security dependant on an application. 

4.2.12 EFsPN (Service Provider Name) 

This EF contains the service provider name and appropriate requirements for the display by the ME. 



Identifier: '6F46' 




Structure 


transparent 




Optional 


File Size: 17 


bytes 




Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




ALWAYS 
ADM 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 


Display Condition 


M 


1 byte 


2- 17 


Service Provider Name 


M 


1 6 bytes 



Display Condition 

Contents: display condition for the service provider name in respect to the registered PLMN (see 

GSM 02.07 [17]). 
Coding: 



bl=0 : display of registered PLMN not required 
bl=l : display of registered PLMN required 
RFU (see 3G TS 31 . 101) 



Service Provider Name 
Contents: 

service provider string to be displayed 
Coding: 

the string shall use 

- either the SMS default 7-bit coded alphabet as defined in 3G TS 23.038 [5] with bit 8 set to 0. The string 
shall be left justified. Unused bytes shall be set to 'FF'. 
or one of the UCS2 code options defined in the annex of3GTS 31.101 [11]. 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
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4.2.13 EFpucT (Price per Unit and Currency Table) 

This EF contains the Price per Unit and Currency Table (PUCT). The PUCT is Advice of Charge related information 
which may be used by the ME in conjunction with EFacm to compute the cost of calls in the currency chosen by the 
subscriber, as specified in 3G TS 22.024 [3]. This EF shall always be allocated if EFacm is allocated. 



Identifier: '6F41' 


Structure: transparent Optional 


File size: 5 bytes 


Update activity: low 


Access Conditions: 
READ 
UPDATE 

DEACTIVATE 
ACTIVATE 


PIN 

PIN/PIN2 

(fixed during administrative management) 

ADM 

ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Currency code 


M 


3 bytes 


4-5 


Price per unit 


M 


2 bytes 



Currency code 

Contents: 

the alpha-identifier of the currency code. 

Coding: 

bytes 1, 2 and 3 are the respective first, second and third character of the alpha identifier. This alpha-tagging 
shall use the SMS default 7-bit coded alphabet as defined in 3G TS 23.038 [5] with bit 8 set to 0. 

Price per unit 

Contents: 

price per unit expressed in the currency coded by bytes 1-3. 

Coding: 

byte 4 and bits bl to b4 of byte 5 represent the Elementary Price per Unit (EPPU) in the currency coded by 
bytes 1 -3 . Bits b5 to b8 of byte 5 are the decimal logarithm of the multiplicative factor represented by the 
absolute value of its decimal logarithm (EX) and the sign of EX, which is coded for a positive sign and 1 
for a negative sign. 

Byte 4: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



,11 ,10 ,9 ,8 ,7 ,6 ,5 ,4 of EPPU 



Byte 5: 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



2 



of EPPU 



Sign of EX 
2° of Abs (EX) 
2^ of Abs (EX) 
2^ of Abs (EX) 



The computation of the price per unit value is made by the ME in compliance with 3G TS 22.024 [3] by the 
following formula: 

price per unit = EPPU * 10^^. 

The price has to be understood as expressed in the coded currency. 

If a GSM application is present on the UICC and the PUCT information is to be shared between the GSM and the 
USIM application, then this file shall be shared between the two applications. 
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4.2.14 EFcBMi (Cell Broadcast Message identifier selection) 

This EF contains the Message Identifier Parameters which specify the type of content of the cell broadcast messages 
that the subscriber wishes the UE to accept. 

Any number of CB Message Identifier Parameters may be stored in the USIM. No order of priority is applicable. 



Identifier: '6F45' Structure: transparent 


Optional 


File size: 2 n bytes Update activity 


: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -2 


CB Message Identifier 1 





2 bytes 


3-4 


CB Message Identifier 2 





2 bytes 










2n-1 - 2n 


CB Message Identifier n 





2 bytes 



Cell Broadcast Message Identifier 
Coding: 

as in 3G TS 23.041 [16], "Message Format on BTS-MS Interface - Message Identifier"; 

values listed show the types of message which shall be accepted by the UE; 

unused entries shall be set to 'FF FF'. 

4.2.15 EFacc (Access Control Class) 

This EF contains the assigned access control class(es). The access control class is a parameter to control the access 
attempts. 15 classes are split into 10 classes randomly allocated to normal subscribers and 5 classes allocated to specific 
high priority users. For more information see 3G TS 22.01 1 [2]. 



Identifier: '6F78' 


Structure 


transparent 


Mandatory 


File size: 2 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -2 


Access control classes 


M 


2 bytes 



Access control classes 
Coding: 

each ACC is coded on one bit. An ACC is "allocated" if the corresponding bit is set to 1 and "not allocated" 

if this bit is set to 0. Bit b3 of byte 1 is set to 0. 

Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



15 14 13 12 11 10 09 08 Number of the ACC (except for bit b3) 



Byte 2: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



07 Oi 



05 04 03 02 



01 



)0 Number of the ACC 
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4.2. 1 6 EFfplmn (Forbidden PLMNs) 



This EF contains the coding for n Forbidden PLMNs (FPLMN). It is read by the ME as part of the USIM initiahzation 
procedure and indicates PLMNs which the UE shall not automatically attempt to access. 

A PLMN is written to the EF if a network rejects a Location Update with the cause "PLMN not allowed". The ME shall 
manage the list as follows. 

When n FPLMNs are held in the EF, and rejection of a further PLMN is received by the ME from the network, the ME 
shall modify the EF using the UPDATE command. This new PLMN shall be stored in the n position, and the existing 
list "shifted" causing the previous contents of the first position to be lost. 

When less than n FPLMNs exist in the EF, storage of an additional FPLMN shall not cause any existing FPLMN to be 
lost. 

Dependent upon procedures used to manage storage and deletion of FPLMNs in the EF, it is possible, when less than n 
FPLMNs exist in the EF, for 'FFFFFF' to occur in any position. The ME shall analyse all the EF for FPLMNs in any 
position, and not regard 'FFFFFF' as a termination of valid data. 



Identifier: '6F7B' 


Structure: transparent 


Mandatory 


File size: n*3 bytes (n> 


3) Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 

ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 -3 


PLMN 1 


M 


3 bytes 


4-6 


PLMN 2 


M 


3 bytes 


7-9 


PLMNS 


M 


3 bytes 


10- 12 


PLMN 4 


M 


3 bytes 










(3n-2) to 3n 


PLMNn 





3 bytes 



- PLMN 
Contents: 

Mobile Country Code (MCC) followed by the Mobile Network Code (MNC). 
Coding: 

according to 3G TS 24.008 [9]. 

For instance, using 246 for the MCC and 8 1 for the MNC and if this is stored in PLMN 3 the contents is as 

follows: 

Bytes 7-9: '42"F6" 18' 
If storage for fewer than n PLMNs is required, the unused bytes shall be set to 'FF'. 

4.2.17 EFloci (Location Information) 

This EF contains the following Location Information: 

Temporary Mobile Subscriber Identity (TMSI); 
Location Area Information (LAI); 
Location update status. 

See clause 5.2.5 for special requirements when updating EFloci- 
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Identifier: '6F7E' Structure: transparent Mandatory 


SFI: '30' 




File size: 11 bytes 


Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE PIN 


Bytes 


Description 


M/0 


Length 


1 -4 


TMSI 


M 


4 bytes 


5-9 


LAI 


M 


5 bytes 


10 


RFU 


M 


1 byte 


11 


Location update status 


M 


1 byte 



TMSI 
Contents: 

Temporary Mobile Subscriber Identity. 
Coding: 

according to 3G TS 24.008 [9]. 



b8 b7 b6 b5 b4 b3 b2 bl 



~~i — — \ — — \ — — \ — — \ — — \ — — \ — — r 

MSB 



LAI 
Contents: 

Location Area Information. 
Coding: 

according to 3G TS 24.008 [9]. 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MCC Digit 1 



MSB of MCC Digit 1 
LSB of MCC Digit 2 



MSB of MCC Digit 2 



Byte 6: second byte of LAI (MCC continued) 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MCC Digit 3 



MSB of MCC Digit 3 
bits b5 to b8 are 1 



Byte 7: third byte of LAI (MNC) 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MNC Digit 1 



MSB of MNC Digit 1 
LSB of MNC Digit 2 



MSB of MNC Digit 2 



Byte 8: fourth byte of LAI (LAC) 

Byte 9: fifth byte of LAI (LAC continued) 
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Location update status 






Contents: 






status of location update according 


I to 


3GTS 24.008 [9]. 


Coding: 






Byte 11: 






Bits: b3 


b2 


bl 








: updated 








1 : not updated 





1 


: PLMN not allowed 





1 


1 : Location Area not allowed 


1 


1 


1 : reserved 



Bits b4 to b8 are RFU (see 3G TS 3L101 [11]). 

4.2.18 EFad (Administrative Data) 

This EF contains information concerning the mode of operation according to the type of USIM, such as normal (to be 
used by PLMN subscribers for 3G operations), type approval (to allow specific use of the ME during type approval 
procedures of e.g. the radio equipment), cell testing (to allow testing of a cell before commercial use of this cell), 
manufacturer specific (to allow the ME manufacturer to perform specific proprietary auto-test in its ME during e.g. 
maintenance phases). 

It also provides an indication of whether some ME features should be activated during normal operation. 



Identifier: '6FAD' Structure: transparent 


Mandatory 


File size: 3+X bytes Update activity 


: low 


Access Conditions: 

READ ALW 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


UE operation mode 


M 


1 byte 


2-3 


Additional information 


M 


2 bytes 


4 -3+X 


RFU 





X bytes 



UE operation mode 
Contents: 

mode of operation for the UE 
Coding: 

Initial value 

- '00' normal operation 

'80' type approval operations 

'Or normal operation H- specific facilities 

'81' type approval operations H- specific facilities 

'02' maintenance (off line) 

'04' cell test operation 

Additional information 
Coding: 

- specific facilities (if bl=l in byte 1); 

Byte 2 (first byte of additional information): 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




1 1 1 1 1 1 1 1 





RFU (see 3G TS 31.101) 
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Byte 3: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

























































bl=0: OFM to be deactivated by the ME 
bl=l: OFM to be activated by the ME 
RFU (see 3G TS 31 . 101) 



The OFM bit is used to control the Ciphering Indicator as specified in GSM 02.07 [17] 
- ME manufacturer specific information (if b2=l in byte 1). 



4.2.19 EFappi (Application Profile Indication) 

This EF contains an indication concerning the application (USIM) profile. 



Identifier: '6FAE' 


Structure: transparent 


Mandatory 


File size: X byte 


Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ALW 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 to 2 


USIM Release 


M 


2 bytes 


3 


USIM Version 


M 


1 byte 


4 


Operator Indication 


M 


1 byte 


5toX 


RFU 





X-4 bytes 



All other codings are reserved for specification by 3GPP. 

- USIM Release 
Contents: 

indicates the TSG-T approved release of the 3G TS 31.102 the USIM is based on. 
Coding: 

'19 99': Release 99 

All other codings are reserved for specification by 3GPP. 

- USIM Version 
Contents: 

indicates the TSG-T approved version of the 31.102 within a Release the USIM is based on. 
Coding: 

according to the '31.102 Change Control Document'. 
Operator Indication 
Contents: 

for use by the operator to indicate different versions of operator-specific USIM applications. 
Coding: 

not within the scope of this specification. 

4.2.20 EFcBMiD (Cell Broadcast Message Identifier for Data Download) 

This EF contains the message identifier parameters which specify the type of content of the cell broadcast messages 
which are to be passed to the USIM. 

Any number of CB message identifier parameters may be stored in the USIM. No order of priority is applicable. 
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Identifier: '6F48' Structure: transparent Optional 


File size: 2n bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1-2 


CB Message Identifier 1 





2 bytes 


3-4 


CB Message Identifier 2 





2 bytes 










2n-1-2n 


CB Message Identifier n 





2 bytes 



Cell Broadcast Message Identifier 
Coding: 

as in 3G TS 23.041 [16]. Values listed show the identifiers of messages which shall be accepted by the UE 

to be passed to the USIM. 

Unused entries shall be set to 'FF FF'. 



4.2.21 EFecc (Emergency Call Codes) 

This EF contains up to 5 emergency call codes. 



Identifier: '6FB7' Structure: transparent 


Optional 


File size: 3n (n < 5) bytes Update activity 


: low 


Access Conditions: 

READ ALW 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Emergency Call Code 1 





3 bytes 


4-6 


Emergency Call Code 2 





3 bytes 










{3n-2) - 3n 


Emergency Call Code n 





3 bytes 



Emergency Call Code 
Contents: 

Emergency Call Code 
Coding: 

the emergency call code is of a variable length with a maximum length of 6 digits. Each emergency call code 

is coded on three bytes, with each digit within the code being coded on four bits as shown below. If a code of 

less than 6 digits is chosen, then the unused nibbles shall be set to 'F'. 

Byte 1: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 1 



MSB of Digit 1 
"lSB of Digit 2 



MSB of Digit 2 
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Byte 2: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 3 



MSB of Digit 3 
LSB of Digit 4 



MSB of Digit 4 



Byte 3: 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 5 



MSB of Digit 5 
LSB of Digit 6 



MSB of Digit 6 



4.2.22 EFcBMiR (Cell Broadcast Message Identifier Range selection) 

This EF contains ranges of cell broadcast message identifiers that the subscriber wishes the UE to accept. 

Any number of CB Message Identifier Parameter ranges may be stored in the USIM. No order of priority is applicable. 



Identifier: '6F50' Structure: transparent 


Optional 


File size: 4n bytes Update activity 


: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -4 


CB Message Identifier Range 1 





4 bytes 


5-8 


CB Message Identifier Range 2 





4 bytes 










(4n-3) - 4n 


CB Message Identifier Range n 





4 bytes 



Cell Broadcast Message Identifier Ranges 

Contents: 

CB Message Identifier ranges: 

Coding: 

bytes one and two of each range identifier equal the lower value of a cell broadcast range, bytes three and 
four equal the upper value of a cell broadcast range, both values are coded as in 3G TS 23.041 [16] 
"Message Format on BTS-MS Interface - Message Identifier". Values listed show the ranges of messages 
which shall be accepted by the UE. 
Unused entries shall be set to 'FF FF FF FF'. 

4.2.23 EFpsLoci (Packet Switched location information) 

This EF contains the following Location Information: 

Packet Temporary Mobile Subscriber Identity (P-TMSI); 

Packet Temporary Mobile Subscriber Identity signature value (P-TMSI signature value); 
Routing Area Information (RAI); 
- Routing Area update status. 
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Identifier: '6F53' Structure: transparent 


Optional 


SFI: Recommended 




File size: 14 bytes 


Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 4 


P-TMSI 


M 


4 bytes 


5 to 7 


P-TMSI signature value 


M 


3 bytes 


8to13 


RAI 


M 


6 bytes 


14 


Routing Area update status 


M 


1 byte 



P-TMSI 
Contents: 

Packet Temporary Mobile Subscriber Identity. 
Coding: 

according to 3G TS 24.008 [9]. 

Byte 1: first byte of P-TMSI 



b8 


b7 


B6 


B5 


B4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



MSB 



P-TMSI signature value 
Contents: 

Packet Temporary Mobile Subscriber Identity signature value. 
Coding: 

according to 3G TS 24.008 [9]. 



Byte 5: first byte of P-TMSI signature value 



b8 


b7 


B6 


B5 


B4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



MSB 



RAI 

Contents: 

Routing Area Information. 
Coding: 

according to 3G TS 24.008 [9]. 

Byte 8: first byte of RAI 



B7 



b6 



b5 



b3 



b2 



bl 



LSB of MCC Digit 1 



MSB of MCC Digit 1 
LSB of MCC Digit 2 



MSB of MCC Digit 2 
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Byte 9: second byte of RAI (MCC continued) 



b8 



b7 



b6 



b5 



b3 



b2 



bl 



LSB of MCC Digit 3 



MSB of MCC Digit 3 
bits b5 to b8 are 1 



Byte 10: third byte of RAI (MNC) 



b7 



b6 



b5 



b3 



b2 



bl 



LSB of MNC Digit 1 



MSB of MNC Digit 1 
LSB of MNC Digit 2 



MSB of MNC Digit 2 



Byte 1 1 : fourth byte of RAI (LAC) 

Byte 12: fifth byte of RAI (LAC continued) 

Byte 13: sixth byte of RAI (RAC) 



Routing update status 






Contents: 






status of location update according to 


3GTS 24.008 [9]. 


Coding: 






byte 14: 






Bits: b3 


b2 


bl 








: updated 








1 : not updated 





1 


: PLMN not allowed 





1 


1 : Routing Area not allowed 


1 


1 


1 : reserved 



Bits b4 to b8 are RFU (see 3G TS 31.101 [11]). 

4.2.24 EFfdn (Fixed Dialling Numbers) 

This EF contains Fixed Dialling Numbers (FDN) and/or Supplementary Service Control strings (SSC). In addition it 
contains identifiers of associated network/bearer capabilities and identifiers of extension records at the USIM ADF 
level. It may also contain an associated alpha-tagging. 



Identifier: '6F3B' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN2 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Identifier 


M 


1 byte 


X+14 


Extension2 Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EFadn (subclause 4.4.3.3), with the 
exception that extension records are stored in the EFext2- 
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NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 



4.2.25 EFsMs (Short messages) 



This EF contains information in accordance with 3G TS 23.040 [6] comprising short messages (and associated 
parameters) which have either been received by the UE from the network, or are to be used as an UE originated 

message. 



Identifier: '6F3C' Structure: 


linear fixed Optional 


Record lengtli: 176 bytes 


Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Status 


M 


1 byte 


2 to 176 


Remainder 


M 


1 75 bytes 



Status 

Contents: 

Status byte of the record which can be used as a pattern in the SEARCH RECORD command. For UE 
originating messages sent to the network, the status shall be updated when the UE receives a status report, or 
sends a successful SMS Command relating to the status report. 

Coding: 



b8 b7 b6 b5 b4 b3 b2 bl 



—1 — — I — — r 

X X free space 

XXI used space 

1 message received by UE from network; message read 

Oil message received by UE from network; message to be 

read 

111 UE originating message; message to be sent 

RFU (see 3GTS31.101 [11]) 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














X 


X 


1 





1 




















1 





1 

















1 


1 





1 














1 





1 





1 














1 


1 


1 





1 



1 UE originating message; message sent to the network: 

Status report not requested 

Status report requested but not (yet) received; 

Status report requested, received but not stored 

in EF-SMSR; 

Status report requested, received and stored 

in EF-SMSR; 

RFU (see 3GTS31.101 [11]) 



Remainder 

Contents: 

This data item commences with the TS-Service-Centre-Address as specified in 3G TS 24.011 [10]. The bytes 
immediately following the TS-Service-Centre-Address contain an appropriate short message TPDU as 
specified in 3G TS 23.040 [6], with identical coding and ordering of parameters. 
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Coding: 

according to 3G TS 23.040 [6] and 3G TS 24.01 1 [10]. Any TP-message reference contained in an UE 
originated message stored in the USIM, shall have a value as follows: 



message to be sent: 
message sent to the network: 



Value of the TP -message-reference: 

'FF' 

the value of TP-Message-Reference used in the 

message sent to the network. 



Any bytes in the record following the TPDU shall be filled with 'FF'. 

It is possible for a TS-Service-Centre- Address of maximum permitted length, e.g. containing more than 18 
address digits, to be associated with a maximum length TPDU such that their combined length is 176 bytes. 
In this case the ME shall store in the USIM the TS-Service-Centre-Address and the TPDU in bytes 2-176 
without modification, except for the last byte of the TPDU, which shall not be stored. 

4.2.26 EFmsisdn (MSISDN) 

This EF contains MSISDN(s) related to the subscriber. In addition it contains identifiers of associated network/bearer 
capabilities and identifiers of extension records at the USIM ADF level. It may also contain an associated 
alpha-tagging. 



Identifier: '6F40' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN/ADM 

(fixed during administrative management) 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


10 bytes 


X+1 3 


Capability/Configuration2 Identifier 


M 


1 byte 


X+14 


Extensions Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of EFadn- 

If the USIM stores more than one MSISDN number and the ME displays the MSISDN number(s) within the 
initialisation procedure then the one stored in the first record shall be displayed with priority. 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 

4.2.27 EFsMSP (Short message service parameters) 

This EF contains values for Short Message Service header Parameters (SMSP), which can be used by the ME for user 
assistance in preparation of mobile originated short messages. For example, a service centre address will often be 
common to many short messages sent by the subscriber. 

The EF consists of one or more records, with each record able to hold a set of SMS parameters. The first (or only) 
record in the EF shall be used as a default set of parameters, if no other record is selected. 

To distinguish between records, an alpha-identifier may be included within each record, coded on Y bytes. 

The SMS parameters stored within a record may be present or absent independently. When a short message is to be sent 
from the UE, the parameter in the USIM record, if present, shall be used when a value is not supplied by the user. 



ETSI 



(3G IS 31.102 version 3.0.0 Release 1999) 



32 



ETSI TS 131 102 V3.0.0 (2000-01) 



Identifier: '6F42' Structure: linear fixed 


Optional 


Record length: 28+Y bytes Update activity: 


low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toY 


Alpha-Identifier 





Y bytes 


Y+1 


Parameter Indicators 


M 


1 byte 


Y+2toY+13 


TP-Destination Address 


M 


1 2 bytes 


Y+14toY+25 


TS-Service Centre Address 


M 


12 bytes 


Y+26 


TP-Protocol Identifier 


M 


1 byte 


Y+27 


TP-Data Coding Scheme 


M 


1 byte 


Y+28 


TP-Validity Period 


M 


1 byte 



Storage is allocated for all of the possible SMS parameters, regardless of whether they are present or absent. Any bytes 
unused, due to parameters not requiring all of the bytes, or due to absent parameters, shall be set to 'FF'. 

Alpha-Identifier 
Contents: 

Alpha Tag of the associated SMS-parameter. 
Coding: 

see subclause 4.4.3.3 (EFadn)- 

NOTE: The value of Y may be zero, i.e. the alpha-identifier facility is not used. By using the command GET 
RESPONSE the ME can determine the value of Y. 

Parameter Indicators 
Contents: 

each of the default SMS parameters which can be stored in the remainder of the record are marked absent or 

present by individual bits within this byte. 
Coding: 

allocation of bits: 

bit number Parameter indicated 

1 TP-Destination Address 

2 TS-Service Centre Address 

3 TP-Protocol Identifier 

4 TP-Data Coding Scheme 

5 TP-Validity Period 

6 reserved, set to 1 

7 reserved, set to 1 

8 reserved, set to 1 



Bit value 


1 



Meaning 

Parameter present 
Parameter absent 



TP-Destination Address 
Contents and Coding: 

as defined for SM-TL address fields in 3G TS 23.040 [6]. 

TP-Service Centre Address 
Contents and Coding: 

as defined for RP -Destination address Centre Address in 3G TS 24.01 1 [10]. 

TP-Protocol Identifier 
Contents and Coding: 

as defined in 3G TS 23.040 [6]. 

TP-Data Coding Scheme 
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Contents and Coding: 

as defined in 3G TS 23.038 [5]. 

- TP- Validity Period 
Contents and Coding: 

as defined in 3G TS 23.040 [6] for the relative time format. 

4.2.28 EFsMss (SMS status) 

This EF contains status information relating to the short message service. 

The provision of this EF is associated with EFsms- Both files shall be present together, or both absent from the USIM. 



Identifier: '6F43' Structure: transparent 


Optional 


File size: 2+X bytes Update activity 


: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Last Used TP-MR 


M 


1 byte 


2 


SMS "Memory Cap. Exceeded" Not. Flag 


M 


1 byte 


3 to 2+X 


RFU 





X bytes 



Last Used TP-MR. 
Contents: 

the value of the TP-Message-Reference parameter in the last mobile originated short message, as defined in 

3GTS 23.040 [6]. 
Coding: 

as defined in 3G TS 23.040 [6]. 

SMS "Memory Capacity Exceeded" Notification Flag. 
Contents: 

this flag is required to allow a process of flow control, so that as memory capacity in the UE becomes 

available, the Network can be informed. The process for this is described in 3G TS 23.040 [6]. 
Coding: 

bl=l means flag unset; memory capacity available; 

bl=0 means flag set; 

b2 to b8 are reserved and set to 1 . 



4.2.29 EFsDN (Service Dialling Numbers) 



This EF contains special service numbers (SDN) and/or the respective supplementary service control strings (SSC). In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records at the USIM 
ADF level. It may also contain associated alpha-tagging. 
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Identifier: '6F49' Structure: linear fixed Optional 


Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1-X 


Alpha identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 bytes 


X+2 


TON and NPI 


M 


1 byte 


X+3-X+12 


Dialling Number/SSC String 


M 


10 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+14 


Extensions Record Identifier 


M 


1 byte 



For contents and coding of all data items see the respective data items of the EFadn (subclause 4.5. 1), with the 
exception that extension records are stored in the EFext3- 

NOTE: The value of X (the number of bytes in the alpha-identifier) may be different to the length denoted X in 

EFadn- 



4.2.30 EFext2 (Extension2) 

This EF contains extension data of an FDN (see FDN in 4.2.24). 



Identifier: '6F4B' Structure: 


linear fixed 


Optional 


Record length: 13 bytes 


Update activity 


: low 


Access Conditions: 

READ PIN 
UPDATE PIN2 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see subclause 4.5.2 (EFexti)- 



4.2.31 EFexts (Extension3) 

This EF contains extension data of an SDN (see SDN in 4.2.29). 



Identifier: '6F4C' Structure: 


linear fixed 


Optional 


Record length: 13 bytes 


Update activity 


: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


1 1 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see subclause 4.5.2 EFexti- 
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4.2.32 EFsMSR (Short message status reports) 

This EF contains information in accordance with 3G TS 23.040 [6] comprising short message status reports which have 
been received by the UE from the network. 

Each record is used to store the status report of a short message in a record of EFsms- The first byte of each record is the 
link between the status report and the corresponding short message in EFsms- 



Identifier: '6F47' Structure: linear fixed Optional 


Record length: 30 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


SMS record identifier 


M 


1 


2-30 


SMS status report 


M 


29 bytes 



SMS record identifier 
Contents: 

this data item identifies the corresponding SMS record in EFsms^ e.g. if this byte is coded '05' then this status 

report corresponds to the short message in record #5 of EFsms- 
Coding: 

'00' - empty record; 

'01 ' - 'FF' - record number of the corresponding SMS in EFsms- 

SMS status report 
Contents: 

this data item contains the SMS-STATUS-REPORT TPDU as specified in 3G TS 23.040 [6], with identical 

coding and ordering of parameters. 
Coding: 

according to 3G TS 23.040 [6]. Any bytes in the record following the TPDU shall be filled with 'FF'. 



4.2.33 EFici (Incoming Call Information) 



This EF is located within the USIM application. The incoming call information can be linked to the phone book stored 
under DFtelecom or to the local phone book within the USIM. The EFici contains the information related to incoming 
calls. 

The time of the call and duration of the call are stored in this EF. This EF can also contain associated alpha identifier 
that may be supplied with the incoming call. In addition it contains identifiers of associated network/bearer capabilities 
and identifiers of extension records at the USIM ADF level. The structure of this EF is cyclic, so the contents shall be 
updated only after a call is disconnected. 

If CLI is supported and the incoming phone number matches a number stored in the phone book the incoming call 
information is linked to the corresponding information in the phone book. If the incoming call matches an entry but is 
indicated as hidden in the phone book the link is established but the information is not displayed by the ME if the code 
for the secret entry has not been verified. The ME shall not ask for the secret code to be entered at this point. 

Optionally the ME may store the link to phone book entry in the file, so that it does not need to look again for a match 
in the phone book when it reuses the entry. But the ME will have to check that the incoming call number still exits in 
the linked phone book entry, as the link might be broken (entry modified). When not used by the ME or no link to the 
phone book has been found, this field shall be set to 'FFFFFF'. 

The first byte of this link is used to identify clearly the phone book location either global (i.e. under DFxelecom) or local 
(i.e. USIM specific). To allow the reuse of the referring mechanism in further implementation of the phonebook under 
discussion, this byte can be used to indicate those. 

For the current version of the phone book, the phone book entry is identified as follows: 
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the record number in the EFpbr which indicates the EFadn containing the entry; 
the record number inside the indicated EFadn- 
The structure of EFjci is shown below. Coding scheme is according to EFadn 



Structure of EF 



101 



Identifier: '6F80' Structure: Cyclic Optional 


Record length: X+28 bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Incoming Call Number 


M 


1 bytes 


X+1 3 


Capability/Configuration2 Identifier 


M 


1 byte 


X+1 4 


Extensions Record Identifier 


M 


1 byte 


X+15toX+21 


Incoming call date and time (see detail 1) 


M 


7 bytes 


X+22 to X+24 


Incoming call duration (see detail 2) 


M 


3 bytes 


X+25 


Incoming call status (see detail 3) 


M 


1 byte 


X+26 to X+28 


Link to phone book entry (see detail 4) 


M 


3 bytes 



























NOTE: When the contents except incoming call status are invalid, they are filled with 'FF'. 

Detail 1 Coding of date and time 

Content: 

the date and time are defined by the ME. 

Coding: 

it is according to the extended BCD coding from Bytel to Byte 7. The first 3 bytes show year, month and 
day (yy.mm.dd). The next 3 bytes show hour, minute and second (hh.mm.ss). The last Byte 7 is Time 
Zone. The Time Zone indicates the difference, expressed in quarters of an hour, between the local time 
and GMT. Bit 4 in Byte 7 represents the algebraic sign of this difference (0: positive, 1: negative). If the 
terminal does not support the Time Zone, Byte 8 shall be "FF". Byte X+15: Year 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of first digit year 



MSB of first digit year 
LSB of second digit year 



MSB of second digit year 



Byte X+16: Month 
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b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of first digit month 



MSB of first digit month 
LSB of second digit month 



MSB of second digit month 



Byte X+17: Day 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of first digit day 



MSB of first digit day 
LSB of second digit day 



MSB of second digit day 



Byte X+1 8: Hour 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of first digit hour 



MSB of first digit hour 
LSB of second digit hour 



MSB of second digit hour 



Byte X+19: Minute 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of first digit minute 



MSB of first digit minute 
LSB of second digit minute 



MSB of second digit minute 



Byte X+20: Second 



bS 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of first digit second 



MSB of first digit second 
LSB of second digit second 



MSB of second digit second 



Byte X+21: Time Zone 
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b8 b7 b6 b5 b4 b3 b2 bl 



LSB of first digit indicates by quarters an hour 

MSB of first digit indicates by quarters an hour 

the algebraic sign (0: positive, 1: negative) 

LSB of second digit indicates by quarters an hour 



MSB of second digit indicates by quarters an hour 



Detail 2 Coding of call duration 

Call duration is indicated by second 
Byte X+22: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


1 


1 


1 


1 


1 


1 


1 


1 



223 2^2 221 2^0 2^^ 2^^ 2^'^ 2^^ 



Byte X+23: 



b8 


b7 


b6 


b5 


b4 


bS 


b2 


b1 


1 


1 


1 


1 


1 


1 


1 


1 



2I5 214 213 2I2 2II 2IO 2^ 2^ 
Byte X+24: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


1 


1 


1 


1 


1 


1 


1 


1 



2^ 2^ 2^ 2^ 2^ 2^ 2I 2^ 



For instance, '00' '00' '30' represents 2^+2^. 
Detail 3 Coding of Call status 
Byte X+25: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 




















1 

































Answered= ' ' / Not Answered='l' 
RFU 



Detail 4 Link to phone book entry 
For the current implementation of the phone book the following coding applies: 
- Phone book reference. 
Byte X+26: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

























































Global Phone Book (DFxelecom) 

1 Local Phone Book (USIM Specific) 
RFU 



EFpBR record number : 

Byte X+27: Hexadecimal value 
EFadn record number : 
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Byte X+28: Hexadecimal value 



4.2.34 EFoci (Outgoing Call Information) 



This EF is application located within the USIM application. The outgoing call information can be linked to the phone 
book stored under DFxelecom or to the local phone book within the USIM. The EFqci contains the information related to 
outgoing calls. 

The time of the call and duration of the call are stored in this EF. It may also contain associated aplha identifier. In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records at the USIM 
ADF level. The structure of this file is cyclic, so the contents shall be updated only after a call is disconnected. 

If the dialled phone number matches a number stored in the phone book the outgoing call information might be linked 
to the corresponding information in the phone book. The dialled number may match with a hidden entry in the phone 
book. If the dialled number matches a hidden entry in the phone book the link is established but the information related 
to the phone book entry is not displayed by the ME, if the hidden code has not been verified. The ME shall not perform 
hidden code verification at this point. 

Optionally, the ME may store the link to phone book entry in the file, so that it does not need to look again for a match 
in the phone book when it reuses the entry. But the ME will have to check that the outgoing call number still exists in 
the linked phone book entry, as the link might be broken (entry modified). When not used by the ME or no link to the 
phone book has been found, this field shall be set to 'FFFFFF'. 



Coding scheme is according to EFjci. 



Structure of EFqci 



Identifier: '6F81' Structure: Cyclic Optional 


Record length: X+26 bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Outgoing Call Number/SSC String 


M 


10 bytes 


X+1 3 


Capability/Configuration2 Identifier 


M 


1 byte 


X+1 4 


Extensions Record Identifier 


M 


1 byte 


X+15toX+21 


Outgoing call date and time 


M 


7 bytes 


X+22 to X+24 


Outgoing call duration 


M 


3 bytes 


X+25 to X+27 


Link to Phone Book Entry 


M 


3 bytes 











NOTE: When the contents are invalid, they are filled with "FF". 

4.2.35 EFicT (Incoming Call Timer) 

This EF contains the accumulated incoming call timer duration value for the current call and previous calls. The EF is 
USIM specific and resides within the USIM application. 
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Structure of EFict 



Identifier: '6F82' Structure: cyclic Optional 


Record length: 3 bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN/PIN2 

(fixed during administrative management) 
INCREASE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Accumulated call timer value 


M 


3 bytes 



Coding: 

Accumulated call timer value is indicated by second. 
Byte 1: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


1 


1 


1 


1 


1 


1 


1 


1 



223 2^2 2^1 2^0 2^^ 2^^ 2^'^ 2^^ 



Byte 2: 



b8 


b7 


b6 


b5 


b4 


bS 


b2 


b1 


1 


1 


1 


1 


1 


1 


1 


1 



2I5 2'' 4 2'' 3 2'' 2 2'''' 2''° 2^ 2^ 



Byte 3: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


b1 


1 


1 


1 


1 


1 


1 


1 


1 



o7 oQ 2^ 2^ 2*^ 2^ 2^ 2P 
For example, '00' '00' '30' represents 2^+2^. 

4.2.36 EFocT (Outgoing Call Timer) 

This EF contains the accumulated outgoing call timer duration value for the current call and previous calls. The EF is 
USIM specific and resides within the USIM application. The contents of this EF shall be updated only after a call is 
disconnected. The coding of this EF is the same as EFict- 

Structure of EFqct 



Identifier: '6F83' Structure: cyclic Optional 


Record length: 3 bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN/PIN2 

(fixed during administrative management) 
INCREASE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -3 


Accumulated call timer value 


M 


3 bytes 
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4.2.37 EFexts (Extensions) 



This EF contains extension data of EFici, EFqci and EFmsisdn of the USIM application. 



Identifier: '6F4E' Structure: 


linear fixed 


Optional 


Record length: 13 bytes 


Update activity 


: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



For contents and coding see EFexti- 

4.2.38 EFccp2 (Capability Configuration Parameters 2) 

This EF contains parameters of required network and bearer capabiHties and terminal configurations associated with a 
call established using a fixed dialling number, an MSISDN, a service dialling number, an incoming call or an outgoing 
call. It is referred by EFfdn. EFmsisdn. EFsdn. EFjci and EFqci at USIM ADF level. 



Identifier: '6F4F' 


Structure: linear fixed Optional 


SFI: optional 




Record length: 14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 10 


Bearer capability information element 


M 


1 bytes 


11 to 14 


Bytes reserved - see below 


M 


4 bytes 



Bearer capability information elements 

Contents and Coding: 

see 3G TS 24.008 [9]. The Information Element Identity (lEI) shall be excluded, i.e. the first byte of the 
EFccp2 record shall be Length of the bearer capability contents. 

Bytes 11-14 shall be set to 'FF' and shall not be interpreted by the terminal. 

4.2.39 EFeMLPP (enlnanced Multi Level Precedence and Pre-emption) 

This EF contains information about priority levels and fast call set-up conditions for the enhanced Multi Level 
Precedence and Pre-emption service that can be used by the subscriber. 



ETSI 



(3G IS 31.102 version 3.0.0 Release 1999) 



42 



ETSI TS 131 102 V3.0.0 (2000-01) 



Identifier: '6FB5' Structure: transparent Optional 


File size: 2 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Priority levels 


M 


1 byte 


2 


Fast call set-up conditions 


M 


1 byte 



Priority levels 

Contents: 

the eMLPP priority levels subscribed to. 

Coding: 

each eMLPP priority level is coded on one bit. Priority levels subscribed to have their corresponding bits set 
to 1 . Priority levels not subscribed to have their corresponding bits set to 0. Bit b8 is reserved and set to 0. 

Byte 1: 



b7 b6 b5 b4 b3 b2 bl 



priority level A 

priority level B 

priority level 

priority level 1 

priority level 2 

priority level 3 

priority level 4 

"o 



Example: If priority levels B and 2 are subscribed to, EFcmlpp shall be coded '12'. 

Fast call set-up conditions 
Contents: 

for each eMLPP priority level, the capability to use a fast call set-up procedure. 
Coding: 

each eMLPP priority level is coded on one bit. Priority levels for which fast call set-up is allowed have their 

corresponding bits set to 1 . Priority levels for which fast call set-up is not allowed have their corresponding 

bits set to 0. Bit b8 is reserved and set to 0. 

Byte 2: fast call set-up condition for: 



b7 b6 b5 b4 b3 b2 bl 



fast call set-up condition for priority level A 

fast call set-up condition for priority level B 

fast call set-up condition for priority level 

fast call set-up condition for priority level 1 

fast call set-up condition for priority level 2 

fast call set-up condition for priority level 3 

fast call set-up condition for priority level 4 

'o 



Example: If fast call set-up is allowed for priority levels B, and 2, then byte 2 of EFsmlpp is coded '16'. 

4.2.40 EFaaom (Automatic Answer for eMLPP Service) 

This EF contains those priority levels (of the Multi Level Precedence and Pre-emption service) for which the ME shall 
answer automatically to incoming calls. 
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Identifier: '6FB6' 




Structure 


transparent 


Optional 


File size: 1 


byte 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Automatic answer 


priority levels 




M 


1 byte 



Automatic answer priority levels 

Contents: 

for each eMLPP priority level, the capability for the mobile station to answer automatically to incoming calls 
(with the corresponding eMLPP priority level). 

Coding: 

each eMLPP priority level is coded on one bit. Priority levels allowing an automatic answer from the mobile 
station have their corresponding bits set to 1 . Priority levels not allowing an automatic answer from the 
mobile station have their corresponding bits set to 0. Bit b8 is reserved and set to 0. 
Byte 1: 



b7 b 



b5 b4 b3 b2 bl 



Automatic 
Automatic 
Automatic 
Automatic 
Automatic 
Automatic 
Automatic 

"o 



answer priority for 
answer priority for 
answer priority for 
answer priority for 
answer priority for 
answer priority for 
answer priority for 



priority level A 
priority level B 
priority level 
priority level 1 
priority level 2 
priority level 3 
priority level 4 



Example: If automatic answer is allowed for incoming calls with priority levels A, and 1, then EFaacm is coded 
'OD'. 

4.2.41 EFgmsi (Group Identity) 

This EF contains the group identity of the mobile subscriber. This group identity references a group key GK, stored in 
the USIM, which is used for enhanced user identity confidentiality (enciphering of the IMSI). 



Identifier: '6FC2' 


Structure 


transparent Optional 


File size: 4 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
ADM 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 to 4 


Group Identity 


M 


4 bytes 



Group Identity GMSI 
Coding: 

the least significant bit of GMSI is the least significant bit of the 4* byte. The most significant bit of GMSI is 

the most significant bit of the first byte. 
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4.2.42 EpHiddenkey (Key for hidden phone book entries) 

This EF contains the hidden key that has to be verified by the ME in order to display the phone book entries that are 
marked as hidden. The hidden key can consist of 4 to 8 digits. 



Identifier: '6FC3' 


Structure 


transparent Optional 


File size: 4 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 to 4 


Hidden Key 


M 


4 bytes 



Hidden Key 
Coding: 

the hidden key is coded on 4 bytes using BCD coding. The minimum number of digits is 4. Unused digits are 

padded with 'FF'. 

NOTE: The phone book entries marked as hidden are not scrambled by means of the hidden key. The are stored 
in plain text in the phone book. 



4.2.43 Files required for 2G Access 



The EFs described in this chapter are required for the USIM application to be able to access service through a GSM 
network. 

The presence of these files and thus the support of a 2G access is indicated in the 'USIM Service Table' as service no. 
'27' being available. 

4.2.43.1 EFkc (Ciphering key Kc) 

This EF contains the ciphering key Kc and the ciphering key sequence number n for enciphering in a GSM access 
network. 



Identifier: '6F20' 


Structure 


transparent 


Optional 


File size: 9 bytes 




Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 to 8 


Cipliering l<ey Kc 


M 


8 bytes 


9 


Cipliering key se 


quence number n 




M 


1 byte 



Ciphering key Kc 
Coding: 

the least significant bit of Kc is the least significant bit of the eighth byte. The most significant bit of Kc is 

the most significant bit of the first byte. 

Ciphering key sequence number n 
Coding: 



bits b4 to b8 are coded 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
















1 1 1 
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NOTE: 3G TS 24.008 [9] defines the value of n=l 1 1 as "key not available". Therefore the value '07' and not 'FF' 
should be present following the administrative phase. 

4.2.43.2 EFkcgprs (GPRS Ciphering key KcGPRS) 

This EF contains the ciphering key KcGPRS and the ciphering key sequence number n for GPRS (see 3G TS 23.060 
[7]). 



Identifier: '6F52' 


Structure 


: transparent 


Optional 


File size: 9 bytes 




Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -8 


Cipliering l<ey KcGPRS 


M 


8 bytes 


9 


Cipliering l<ey sequence number n 


for GPRS 


M 


1 byte 



Ciphering key KcGPRS 
Coding: 

the least significant bit of KcGPRS is the least significant bit of the eighth byte. The most significant bit of 

KcGPRS is the most significant bit of the first byte. 

Ciphering key sequence number n for GPRS 
Coding: 



bits b4 to b8 are coded 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
















1 1 1 

























NOTE: TS 24.008 [9] defines the value of n=l 11 as "key not available". Therefore the value '07' and not 'FF' 
should be present following the administrative phase. 

4.2.43.3 EFlocigprs (GPRS location information) 

This EF contains the following Location Information: 

Packet Temporary Mobile Subscriber Identity (P-TMSI); 

Packet Temporary Mobile Subscriber Identity signature value (P-TMSI signature value); 

Routing Area Information (RAI); 

Routing Area update status. 



Identifier: '6F53' Structure: transparent 


Optional 


File size: 14 bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 -4 


P-TMSI 


M 


4 bytes 


5 to 7 


P-TMSI signature value 


M 


3 bytes 


8-13 


RAI 


M 


6 bytes 


14 


Routing Area update status 


M 


1 byte 



P-TMSI 
Contents: 

Packet Temporary Mobile Subscriber Identity. 
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Coding: 

according to TS 24.008 [9]. 

Byte 1: first byte of P-TMSI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



MSB 



P-TMSI signature value 
Contents: 

Packet Temporary Mobile Subscriber Identity signature value. 
Coding: 

according to TS 24.008 [9]. 

Byte 1 : first byte of P-TMSI signature value 



b8 b7 b6 b5 b4 b3 b2 bl 



~~i — — \ — — \ — — \ — — \ — — \ — — \ — — r 

MSB 



RAI 

Contents: 

Routing Area Information. 
Coding: 

according to TS 24.008 [9]. 

Byte 5: first byte of RAI 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MCC Digit 1 



MSB of MCC Digit 1 
LSB of MCC Digit 2 



MSB of MCC Digit 2 



Byte 6: second byte of RAI (MCC continued) 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MCC Digit 3 



MSB of MCC Digit 3 
bits b5 to b8 are 1 



Byte 7: third byte of RAI (MNC) 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MNC Digit 1 



MSB of MNC Digit 1 
LSB of MNC Digit 2 



MSB of MNC Digit 2 



Byte 8: fourth byte of RAI (LAC) 

Byte 9: fifth byte of RAI (LAC continued) 

Byte 10: sixth byte of RAI (RAC)- Routing update status 

Contents: 

status of location update according to TS 24.008 [9]. 
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Coding: 
Byte 12: 



Bits: 



b3 











b2 





1 

1 



bl 



1 



1 



updated 
not updated 
PLMN not allowed 
Routing Area not allowed 



1 1 : reserved 



Bits b4 to b8 are RFU. 



4.2.43.4 EFloci2g (Location Information for 2G access) 

This EF contains the following Location Information: 

Temporary Mobile Subscriber Identity (TMSI); 

- Location Area Information (LAI); 

- TMSI TIME; 

- Location update status. 

See clause 5.2.5 for special requirements when updating EFloci- 



Identifier: '6F7F' Structure: transparent Mandatory 


File size: 1 1 bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE PIN 


Bytes 


Description 


M/0 


Length 


1 -4 


TMSI 


M 


4 bytes 


5-9 


LAI 


M 


5 bytes 


10 


TMSI TIME 


M 


1 byte 


11 


Location update status 


M 


1 byte 



TMSI 
Contents: 

Temporary Mobile Subscriber Identity. 
Coding: 

according to TS 24.008 [9]. 

Byte 1: first byte of TMSI 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 


1 


1 


1 


1 


1 


1 


1 



MSB 
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LAI 
Contents: 

Location Area Information. 
Coding: 

according to TS 24.008 [9]. 

Byte 5: first byte of LAI (MCC) 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MCC Digit 1 



MSB of MCC Digit 1 
LSB of MCC Digit 2 



MSB of MCC Digit 2 



Byte 6: second byte of LAI (MCC continued) 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MCC Digit 3 



MSB of MCC Digit 3 
bits b5 to b8 are 1 



Byte 7: third byte of LAI (MNC) 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of MNC Digit 1 



MSB of MNC Digit 1 
LSB of MNC Digit 2 



MSB of MNC Digit 2 



Byte 8: fourth byte of LAI (LAC) 

Byte 9: fifth byte of LAI (LAC continued) 

- TMSI TIME 
Contents: 

current value of Periodic Location Updating Timer (T3212). 
This byte is used by Phase 1 MEs, but it shall not be used by Phase 2 MEs. 
Location update status 
Contents: 

status of location update according to TS 24.008 [9]. 
Coding: 
byte 11: 

Bits: b3 b2 bl 






1 

Bits b4 to b8 are RFU (see GSM 11.11 [18]). 

4.2.43.5 EFbcch (Broadcast Control Channels) 

This EF contains information concerning the BCCH according to TS 24.008 [9]. 






1 




1 




updated 
not updated 
PLMN not allowed 


1 


1 


Location Area not allowed 


1 


1 


reserved 
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BCCH storage may reduce the extent of a User Equipment's search of BCCH carriers when selecting a cell. The BCCH 
carrier lists in an UE shall be in accordance with the procedures specified in TS 24.008 [9]. The UE shall only store 
BCCH information from the System Information 2 message and not the 2bis extension message. 



Identifier: '6F74' 


Structure 


transparent Optional 


File size: 16 bytes 




Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


PIN 
PIN 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 -16 


BCCH information 


M 


16 bytes 



BCCH information 
Coding: 

the information is coded as octets 2-17 of the "neighbour cells description information element" in 

TS 24.008 [9]. 



4.3 DFs at the USIM ADF (Application DF) Level 

DFs may be present as child directories of USIM ADF. The following DFs are defined: 



DFsoLSA 

DF, 



'5F70' 
'5F3A' 



PHONEBOOK 

(DF for application specific phonebook. This DF has the same structure as the DFphonebook under DFtelecom) 



4.4 Contents of DFs at the USIM ADF (Application DF) level 
4.4.1 Contents of files at the DF SoLSA level 

This subclause specifies the EFs in the dedicated file DFsolsa- It only applies if the SoLSA feature is supported (see 
3G TS 23.073 [8]). 

The EFs contain information about the users subscribed local service areas. 

4.4.1 .1 EFsAi (SoLSA Access Indicator) 

This EF contains the 'LSA only access indicator'. This EF shall always be allocated if DFsolsaIS present. 

If the indicator is set, the network will prevent terminated and/or originated calls when the UE is camped in cells that 
are not included in the list of allowed LS As in EFsll- Emergency calls are, however, always allowed. 

The EF also contains a text string which may be displayed when the UE is out of the served area(s). 



Identifier: '4F30' 




Structure 


transparent 




Optional 


Record length: X-i-1 


bytes 




Update activity 


low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 

ADM 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 


LSA only 


access 


ndicator 




M 


1 byte 


2 to X-i-1 


LSA only 


access 


ndication text 




M 


X bytes 
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LSA only access indicator 
Contents: 

indicates whether the UE is restricted to use LSA cells only or not. 

Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 

























































bl=0 : LSA only access not activated 
bl=l : LSA only access activated 
RFU 



LSA only access indication text 
Contents: 

text to be displayed by the ME when it's out of LSA area. 
Coding: the string shall use either 
- the SMS default 7-bit coded alphabet as defined in 3G TS 23.038 [5] with bit 8 set to 0. The alpha identifier 

shall be left justified. Unused bytes shall be set to 'FF', 
or, 

one of the UCS2 coded options as defined in the annex of 3G TS 31.101 [11]. 

4.4.1 .2 EFsLL (SoLSA LSA List) 

This EF contains information describing the LSAs that the user is subscribed to. This EF shall always be allocated if 

DFsoLSA is present. 

Each LSA is described by one record that is linked to a LSA Descriptor file. Each record contains information of the 
PLMN, priority of the LSA, information about the subscription and may also contain a text string and/or an icon that 
identifies the LSA to the user. The text string can be edited by the user. 



Identifier: '4F31' Structure: linear fixed Optional 


Record length: X+1 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


LSA name 





X bytes 


X+1 


Configuration parameters 


M 


1 byte 


X+2 


RFU 


M 


1 byte 


X+3 


Icon Identifier 


M 


1 byte 


X+4 


Priority 


M 


1 byte 


X+5 to X+7 


PLMN code 


M 


3 bytes 


X+8 to X+9 


LSA Descriptor File Identifier 


M 


2 bytes 


X+10 


LSA Descriptor Record Identifier 


M 


1 byte 



LSA name 
Contents: 

LSA name string to be displayed when the ME is camped in the corresponding area, dependant on the 

contents of the LSA indication for idle mode field. 
Coding: 

the string shall use either 

- the SMS default 7-bit coded alphabet as defined in 3G TS 23.038 [5] with bit 8 set to 0. The alpha 

identifier shall be left justified. Unused bytes shall be set to 'FF', 

or 

one of the UCS2 coded options as defined in the annex of 3G TS 31.101 [11]. 

Configuration parameters 
Contents: 

icon qualifier, control of idle mode support and control of LSA indication for idle mode. 
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Coding: 



b8 b7 b6 b5 b4 b3 b2 



bl 



Icon qualifier 
Idle mode support 
LSA indication for idle mode 
"rfu (see 3G TS 31.101) 



Icon qualifier 
Contents: 

the icon qualifier indicates to the ME how the icon to be used. 

bl, b2: 00: icon is not to be used and may not be present. 

01: icon is self-explanatory, i.e. if displayed, it replace the LSA name 

10: icon is not self-explanatory, i.e. if displayed, it shall be displayed together with the LSA name 

11: RFU 

Idle mode support 
Contents: 

the idle mode support is used to indicate whether the ME shall favour camping on the LSA cells in idle 

mode. 

b3 = : Idle mode support disabled; 

b3 = 1 : Idle mode support enabled. 

LSA indication for idle mode 
Contents: 

the LSA indication for idle mode is used to indicate whether or not the ME shall display the LSA name when 

the ME is camped on a cell within the LSA. 

b4 = : LSA indication for idle mode disabled 
b4 = 1 : LSA indication for idle mode enabled 
Bits b5 to b8 are RFU (see 3GTS 31.101 [11]). 

Icon Identifier 
Contents: 

the icon identifier addresses a record in EFimg- 
Coding: 

binary. 

Priority 
Contents: 

priority of the LSA which gives the ME the preference of this LSA relative to the other LSAs. 
Coding: 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














L 


-L- 


-JL 


-^ 


Priority 
RFU 



'0' is lowest priority 'F' is highest. 

PLMN code 
Contents: 

MCC + MNC for the LSA. 
Coding: 

according to 3G TS 24.008 [9] and EFloci- 

LSA Descriptor File Identifier 
Contents: 

these bytes identity the EF which contains the LSA Descriptors forming the LSA. 
Coding: 

byte Xh-8: high byte of the LSA Descriptor file; 

byte X+9: low byte of the LSA Descriptor file. 

LSA Descriptor Record Identifier 
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Contents: 

this byte identifies the number of the first record in the LS A Descriptor file forming the LSA. 
Coding: 

binary. 

4.4.1 .3 LSA Descriptor files 

Residing under DFsolsa, there may be several LSA Descriptor files. These EFs contains one or more records again 
containing LSA Descriptors forming the LSAs. LSAs can be described in four different ways. As a list of LSA IDs, as a 
Hst of LAC + CIs, as a Hst of CIs or as a list of LACs. As the basic elements (LSA ID, LAC + CI, CI and LAC) of the 
four types of lists are of different length, they can not be mixed within one record. Different records may contain 
different kinds of lists within the EFs. Examples of coding of LSA Descriptor files can be found in Annex F. 



Identifier: '4FXX' Structure: 


linear fixed 


Optional 


Record lengtli: n*X+2 bytes 


Update activity 


low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


LSA descriptor type and number 


M 


1 byte 


2 to X+1 


I""' LSA Descriptor 


M 


X bytes 


X+2 to 2X+1 


2™ LSA Descriptor 


M 


X bytes 










{n-1)*X+2to 
n*X+1 


nth LSA Descriptor 


M 


X bytes 


n*X+2 


Record Identifier 


M 


1 byte 



LSA descriptor type and number 
Contents: 

the LSA descriptor type gives the format of the LSA descriptor and the number of valid LSA Descriptors 

within the record. 

Coding: 



LSA descriptor type 
Number of LSA Descriptors 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


















1 1 





























LSA descriptor type 

Contents: Gives the format of the LSA Descriptors. 
bl,b2: 00: LSA ID. 

01: LAC + CI 

10: CI 

11: LAC 

Number of LSA Descriptors 
Contents: 

the number of valid LSA Descriptors in the record. 
Coding: 

binary, with b8 as MSB and b3 as LSB leaving room for 64 LSA Descriptors per record. 

LSA Descriptor 
Contents: 

Dependant of the coding indicated in the LSA descriptor type: 

in case of LSA ID the field length 'X' is 3 bytes, 
- in case of LAC + CI the field length 'X' is 4 bytes, 
in case of CI the field length 'X' is 2 bytes. 
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in case of LAC the field length 'X' is 2 bytes, 
Coding: 

according to 3G TS 24.008 [9]. 

Record Identifier 
Contents: 

this byte identifies the number of the next record containing the LSA Descriptors forming the LSA. 
Coding: 

record number of next record. 'FF' identifies the end of the chain. 

This file utilises the concept of chaining as for EFexti- 

The identifier '4FXX' shall be different from one LSA Descriptor file to the other and different from the 
identifiers of EFsai and EFsll- For the range of 'XX', see subclause tbd. 

4.4.2 Contents of files at the DF PHONEBOOK level 

The UICC may contain a global phonebook, or application specific phonebooks, or both in parallel. When both 
phonebook types co-exist, they are independent and no data is shared. In this case, it shall be possible for the user to 
select which phonebook the user would like to access. 

The global phonebook is located in DFphonebook under DF-pelecom • Each specific USIM application phonebook is 
located in DFphonebook of its respective Apphcation DFusim- DFphonebook under DFusim and under DF telecom have 
the same structure. Yet DFphonebook under DFusim may contain a different set of files than DFphonebook under 
DFtelecom- All phonebook related EFs are located under their respective DFphonebook- 

USIM specific phonebooks are dedicated to application specific entries. Each application specific phonebook is 
protected by the application PIN 

If a GSM application resides on the UICC, the EFs ADN and EXTl from one DFphonebook (defined at GSM application 
installation) are mapped to DFtelecom- Their file IDs are specified in GSM ILl 1 [18], i.e. EFadn = '6F3A' and EFexti = 
'6F4A', respectively. 

The EF structure related to the public phone book is located under DFphonebook in DFtelecom- A USIM specific phone 
book may exist for application specific entries. The application specific phone book is protected by the application PIN. 
The application specific phone book is a copy of the file structure of the one specified for the public phone book under 
DFtelecom- The application specific phonebook may contain a different set of files than the one in the public area under 
DFtelecom- 

4.4.2.1 EFpBR (Phone Book Reference file) 

This file describes the structure of the phonebook. The reference file is a file that contains information how the 
information in the different files is to be combined together to form a phone book entry. The reference file contains 
records. Each record specifies the structure of up to 254 entries in the phone book. Each phone book entry consists of 
data stored in files indicated in the reference file record. The entry structure shall be the same over all the records in the 
EF pBR. If more than 254 entries are to be stored, a second record is needed in the reference file. The structure of a 
phone book entry is defined by different TLV objects that are stored in a reference file record. The reference file record 
structure describes the way a record in a file that is part of the phonebook is used to create a complete entry. Three 
different types of file linking exist. 

- Type 1 files: Files that contain as many records as the reference/master file (EFadn, EFadni) and are linked on 

record number bases (Reel -> Reel). The master file record number is the reference 

- Type 2 files: Files that contain less entries than the master file and are linked via pointers in the index 

administration file (EFiap) 

- Type 3 files are files that are linked by a TLV object in a record (Grouping information in EFqas) 
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Table 4.1 : Phone Book Reference file Constructed Tags 



Tag Value 


Constructed TAG Description 


'D8' 


Indicating files where the amount of records equal to 
master EF, type 1 


'D9' 


Indicating files that are linked using the index 
administration file, type 2. Order of pointer 
appearance in index administration EF is the same as 
the order of file IDs following this tag 


'DA' 


Indicating files that are addressed inside a TLV 
object, type 3. (The file pointed to is defined by the 
TLV object.) 



The first file ID indicated using constructed Tag 'D8' is called the master EF. Access conditions for all other files in the 
index structure is set to the same as for the master EF unless otherwise specified. 

File IDs indicated using constructed Tag 'D8' is a type 1 file and contains the same number of records as the first file 
that is indicated in the data part of this TLV object. All files following this Tag are mapped one to one using the record 
numbers/IDs of the first file indicated in this TLV object. 

File IDs indicated using constructed Tag 'D9' are mapped to the master EF (the file ID indicated as the first data object 
in the TLV object using Tag 'D8') using the pointers in the index administration file. The order of the pointers in the 
index administration file is the same as the order of the file IDs presented after Tag 'D9'. If this Tag is not present in the 
reference file record the index administration file is not present in the structure. In case the index administration file is 
not present in the structure it is not indicated in the data following tag 'D8'. 

File IDs indicated using constructed Tag 'DA' indicate files that are part of the reference structure but they are addressed 
using TLV objects in one or more of the files that are part of the reference structure. The length of the tag indicates 
whether the file to be addressed resides in the same directory or if a path to the file is provided in the TLV object. 

Each constructed Tag contains a list of primitive Tags indicating the order and the type of data (e.g. ADN, lAP,...) of 
the reference structure. The primitive tag identifies clearly the type of data, its value field indicates the file identifier. 

Table 4.2: Tag definitions for the phone book type of file 



Tag Value 


TAG Description 


'CO' 


EFadn data object 


'C1' 


EFiAP data object 


'C2' 


EFexti data object 


'C3' 


EFsNE data object 


'C4' 


EFanr data object 


'C5' 


EFpBc data object 


'C6' 


EFgrp data object 


'C7' 


EFaas data object 


'C8' 


EFgas data object 


'C9' 


EFuid data object 



Phone Book Reference file EFpbr structure 



Identifier: '4F30' 




Structure: linea 


- fixed 


Optional 


SFI: Optional 




Record Length: 


X bytes 






Update activity 


low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
ADM 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 toX 


TLV object(s) for indicating EFs that 
the phone book structure 


are 


part of 


M 


X bytes 
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4.4.2.2 



EFiAP (Index Administration Phone book) 



This file is present if Tag 'D9' is indicated in the reference file. 

The EF contains pointers to the different records in the files that are part of the phone book. The index administration 
file record number/ID is mapped one to one with the corresponding EFadn (must be record to record). The index 
administration file contains the same amount of records as EFadn- The order of the pointers in an EFiap shall be the 
same as the order of file IDs that appear in the TLV object indicated by Tag 'D9' in the reference file record. The 
amount of bytes in a record is equal to the number of files indicated the EFpbr following tag 'D9'. 

The value 'FF' is an invalid record number/ID and is used in any location in to indicate that no corresponding record in 
the indicated file is available. 

The content of EFiap is set to 'FF' at the personalisation stage. 

Index administration file EFiap structure 



Identifier: '4FXX' 


Structure: linear fixed Optional 


SFI: mandatory 




Record LengtIi: X bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Record number of tine first object indicated after 
Tag 'D9' 


M 


1 byte 


2 


Record number of the second object indicated 
after Tag 'D9' 


M 


1 byte 


X 


Record number of the x'" object indicated after 
Tag 'D9' 


M 


1 byte 



4.4.2.3 



EFadn (Abbreviated dialling numbers) 



This EF contains Abbreviated Dialling Numbers (ADN) and/or Supplementary Service Control strings (SSC). In 
addition it contains identifiers of associated network/bearer capabilities and identifiers of extension records. It may also 
contain an associated alpha-tagging. 

This EF shall always be present if the DFphonebook is present. 



Identifier: '4F3A 


Structure: linear fixed Optional 


SFI: mandatory 




Record length: X+14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier 





X bytes 


X+1 


Length of BCD number/SSC contents 


M 


1 byte 


X+2 


TON and NPI 


M 


1 byte 


X+3toX+12 


Dialling Number/SSC String 


M 


10 bytes 


X+1 3 


Capability/Configuration Identifier 


M 


1 byte 


X+14 


Extensioni Record Identifier 


M 


1 byte 



Alpha Identifier 
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Contents: 

Alpha-tagging of the associated dialling number. 
Coding: 

this alpha-tagging shall use 

either 

- the SMS default 7-bit coded alphabet as defined in 3G TS 23.038 [5] with bit 8 set to 0. The alpha 

identifier shall be left justified. Unused bytes shall be set to 'FF'. 
or 

one of the UCS2 coded options as defined in the annex of 3GTS 31.101 [11]. 

NOTE 1: The value of X may be from zero to 241. Using the command GET RESPONSE the ME can determine 
the value of X. 

Length of BCD number/SSC contents 

Contents: 

this byte gives the number of bytes of the following two data items containing actual BCD number/SSC 
information. This means that the maximum value is 11, even when the actual ADN/SSC information length is 
greater than 11. When an ADN/SSC has extension, it is indicated by the extensionl identifier being unequal 
to 'FF'. The remainder is stored in the EFexti with the remaining length of the additional data being coded in 
the appropriate additional record itself (see subclause 4.4.3.4). 

Coding: 

according to 3G TS 24.008 [9]. 

- TON and NPI 

Contents: 

Type of number (TON) and numbering plan identification (NPI). 

Coding: 

according to 3G TS 24.008 [9]. If the Dialling Number/SSC String does not contain a dialling number, e.g. a 
control string deactivating a service, the TON/NPI byte shall be set to 'FF' by the ME (see note 2). 

NOTE 2: If a dialling number is absent, no TON/NPI byte is transmitted over the radio interface (see 

3G TS 24.008 [9]). Accordingly, the ME should not interpret the value 'FF' and not send it over the radio 
interface. 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 
















1 


1 


1 


1 


NPI 












TON 




















1 



Dialling Number/SSC String 

Contents: 

up to 20 digits of the telephone number and/or SSC information. 

Coding: 

according to 3G TS 24.008 [9] , 3G TS 22.030 [4] and the extended BCD-coding (see table 12). If the 
telephone number or SSC is longer than 20 digits, the first 20 digits are stored in this data item and the 
remainder is stored in an associated record in the EFexti- The record is identified by the Extensionl Record 
Identifier. If ADN/SSC require less than 20 digits, excess nibbles at the end of the data item shall be set to 'F'. 
Where individual dialled numbers, in one or more records, of less than 20 digits share a common appended 
digit string the first digits are stored in this data item and the common digits stored in an associated record in 
the EFexti- The record is identified by the Extension 1 Record Identifier. Excess nibbles at the end of the data 
item shall be set to 'F'. 

Byte Xh-3 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 1 



MSB of Digit 1 
"lSB of Digit 2 



MSB of Digit 2 
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Byte X+4: 



b8 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



LSB of Digit 3 



MSB of Digit 3 
LSB of Digit 4 



MSB of Digit 4 



etc. 

Capability/Configuration Identifier 
Contents: 

capability/configuration identification byte. This byte identifies the number of a record in the EFccp 

containing associated capabiHty/configuration parameters required for the call. The use of this byte is 

optional. If it is not used it shall be set to 'FF'. 
Coding: 

binary. 

Extension 1 Record Identifier 
Contents: 

extensionl record identification byte. This byte identifies the number of a record in the EFexti containing an 

associated called party subaddress or additional data. The use of this byte is optional. If it is not used it shall 

be set to 'FF'. 

if the ADN/SSC requires both additional data and called party subaddress, this byte identifies the additional 

record. A chaining mechanism inside EFexti identifies the record of the appropriate called party subaddress 

(see subclause 4.4.3.4). 
Coding: 

binary. 

NOTE 3: If EFadn is part of the public phone book in DFtelecom it may be used by USIM, GSM and also other 

applications in a multi-application card. If the non-GSM application does not recognise the use of Type of 
Number (TON) and Number Plan Identification (NPI), then the information relating to the national 
dialling plan shall be held within the data item dialling number/SSC and the TON and NPI fields set to 
UNKNOWN. This format would be acceptable for 3G operation and also for the non-GSM application 
where the TON and NPI fields shall be ignored. 

Example: SIM storage of an International Number using E.164 [22] numbering plan 

TON NPI Digit field 



USIM application 

Other application compatible with 3G 



001 0001 abc... 

000 0000 XXX... abc. 



where "abc..." denotes the subscriber number digits (including its country code), and "xxx..." 
denotes escape digits or a national prefix replacing TON and NPI. 

NOTE 4: When the ME acts upon the EFadn with a SEARCH RECORD command in order to identify a character 
string in the alpha-identifier, it is the responsibility of the ME to ensure that the number of characters used 
as SEARCH RECORD parameters are less than or equal to the value of X if the MMI allows the user to 
offer a greater number. 
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Table 4.3: Extended BCD coding 



BCD Value 


Character/Meaning 


'0' 


"0" 


: 


: 


'9' 


"9" 


'A' 


"*" 


'B' 


"#" 


'C 


DTMF Control digit separator (GSM 02.07 [17]) 


'D' 


"Wild" value. This will cause the MMI to prompt the user for a single digit (see GSM 02.07 [17]). 


'E' 


RFU 


'F' 


Endmark e.g. in case of an odd number of digits 



BCD values 'C, 'D' and 'E' are never sent across the radio interface. 
NOTE 5: A second or subsequent 'C BCD value will be interpreted as a 3 second PAUSE (see GSM 02.07 [17]). 

4.4.2.4 EFexti (Extensioni) 

This EF contains extension data of an ADN/SSC, an MSISDN, an ICI or an OCI. This EF shall always be present if the 
DFphonebook is present. 

Extension data is caused by: 

- an ADN/SSC (MSISDN, ICI, OCI) which is greater than the 20 digit capacity of the ADN/SSC (MSISDN, 
ICI, OCI) Elementary File or where common digits are required to follow an ADN/SSC string of less than 20 
digits. The remainder is stored in this EF as a record, which is identified by a specified identification byte 
inside the ADN/SSC (MSISDN, ICI, OCI) Elementary File. The EXTl record in this case is specified as 
additional data; 

an associated called party subaddress. The EXTl record in this case is specified as subaddress data. 



Identifier: '4FXX' 


Structure: 


linear fixed 


Optional 


SFI: Mandatory 




Record length: 


13 byte 


s 


Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 


Record type 


M 


1 byte 


2 to 12 


Extension data 


M 


11 bytes 


13 


Identifier 


M 


1 byte 



Record type 
Contents: 

type of the record. 
Coding: 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Called Party Subaddress 

Additional data 

RFU 



b3-b8 are reserved and set to 0; 

a bit set to 1 identifies the type of record; 

only one type can be set; 

'00' indicates the type "unknown". 
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The following example of coding means that the type of extension data is "additional data": 



b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 


1 




1 




1 




1 




1 




1 




1 

1 


1 





Extension data 

Contents: 

additional data or Called Party Subaddress depending on record type. 

Coding: 

Case 1, Extension! record is additional data: 

The first byte of the extension data gives the number of bytes of the remainder of ADN/SSC (respectively 
MSISDN, ICI, OCI). The coding of remaining bytes is BCD, according to the coding of ADN/SSC 
(MSISDN, ICI, OCI). Unused nibbles at the end have to be set to 'F'. It is possible if the number of 
additional digits exceeds the capacity of the additional record to chain another record inside the EXTl 
Elementary File by the identifier in byte 13. 
Case 2, Extension! record is Called Party Subaddress: 

The subaddress data contains information as defined for this purpose in 3G TS 24.008 [9]. All 
information defined in 3G TS 24.008, except the information element identifier, shall be stored in the 
USIM. The length of this subaddress data can be up to 22 bytes. In those cases where two extension 
records are needed, these records are chained by the identifier field. The extension record containing the 
first part of the called party subaddress points to the record which contains the second part of the 
subaddress. 

Identifier 
Contents: 

identifier of the next extension record to enable storage of information longer than 1 1 bytes. 
Coding: 

record number of next record. 'FF' identifies the end of the chain. 

Example of a chain of extension records being associated to an ADN/SSC. The extension! record identifier 
(Byte !4+X) of ADN/SSC is set to 3. 

Record 



No of Record 


Type 


Extension 


Data 


Nex 


Record 3 


■02' 


XX 


.XX 


'06' 


Record 4 


'xx' 


XX 


.XX 


'xx' 


Record 5 


'01' 


XX 


.XX 


'FF 


Record 6 


'01' 


XX 


.XX 


'05' 



In this example ADN/SSC is associated to additional data (record 3) and a called party subaddress whose length 
is more than ! ! bytes (records 6 and 5). 

4.4.2.5 EFpBc (Phone Book Control) 

This EF contains control information related to each entry in the phone book. This EF contains as many records as the 
EFadn associated with it (must be record to record). Each record in EFpBc points to a record in its EFadn- This file 
indicates the control information and the hidden information of each phone book entry. 

The content of EFpBc is linked to the associated EFadn record by means of the ADN record number/ID (there is a one to 
one mapping of record number/identifiers between EFpcB and EFadn)- 
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Structure of control file EFpBc 



Identifier: '4FXX' 


Structure: 


linear fixed 




Optional 


SFI: Mandatory 




Record lengtli 


2 bytes 


Update activity 


low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 








Bytes 


Description 


M/0 


Length 


1 


Entry Control Information 


M 


1 byte 


2 


Hidden 


Information 




M 


1 byte 



Entry Control Information 
Contents: 

provides some characteristics about the phone book entry (eg modification by a 2G mobile). 
Coding: 



Modified by 2G phone ' 1 ' , no change ' ' 
RFU (see 3G TS 31.101) 



b8 


B7 


b6 


B5 


b4 


B3 


b2 


Bl 




















1 

































Hidden Information 
Contents: 

indicates to which USIM/GSM application of the UICC this phone book entry belongs, so that the 

corresponding secret code can be verified to display the phone book entry, other wise the phone book entry is 

hidden. 
Coding: 

'00' - the phone book entry is not hidden; 

'xx' - record number in EFqir of the associated USIM application. 



4.4.2.6 



EFgrp (Grouping file) 



This EF contains the grouping information for each phone book entry. This file contains as many records as the 
associated EFadn- Each record contains a list of group identifiers to which the entry belongs. 

Structure of grouping file EFqrp 



Identifier: '4FXX' 


Structure: linear fixed Optional 


SFI: Mandatory 




Record Length: X bytes (1 < X <10) Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Group Name Identifier 1 


M 


1 byte 


2 


Group Name Identifier 2 





1 byte 


X 


Group Name Identifier X 





1 byte 



Group Name Identifier x 
Content: 

indicates if the associated entry is part of a group, in that case it contains the record number of the group 

name in EFgas- 

One entry can be assigned to a maximum of 10 groups. 
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Coding: 

'00' - the phone book entry is not part of a group; 
'XX' - record number in EFqas. 



4.4.2.7 



EFaas (Additional number Alpha String) 



This file contains the alpha strings that are associated with the user defined naming tags for additional numbers 
referenced in EFanr- 

Structure of EFaas 



Identifier: '4FXX' 




Structure: 


linear fixed Optional 


SFI: Recommended 




Record lengtli: X 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 toX 


Alpha text string 


M 


X bytes 



Alpha text string 
Content: 

user defined text for additional number. 
Coding: 

same as the alpha identifier in EFadn- 

4.4.2.8 EFgas (Grouping information Alpha String) 

This file contains the alpha strings that are associated with the group name referenced in EFgrp. 

Structure of EFqas 



Identifier: '4FXX' 




Structure: 


linear fixed Optional 


SFI: Recommended 




Record length: X 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 

ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 toX 


Alpha text string 


M 


X bytes 



Alpha text string 
Content: 

group names. 
Coding: 

same as the alpha identifier in EFadn- 



4.4.2.9 



EFanr (Additional Number) 



Several phone numbers can be attached to one EFadn record, using one or several EFanr- The amount of additional 
number entries may be less than or equal to the amount of records in EFadn- The EF structure is linear fixed. Each 
record contains an additional phone number. The first byte indicates whether the record is free or the type of additional 
number referring to the record number in EFaas^ containing the text to be displayed. The following part indicates the 
additional number and the reference to the associated record in the EFadn filc- 
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Structure of EFanr 



Identifier: '4FXX' 


Structure: 


linear fixed 


Optional 


SFI: mandatory 




Record lengtli: X+1 1 bytes 


Update activity 


low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Additional Number identifier 


M 


1 byte 


2to11 


Additional number 


M 


1 bytes 


12 


ADN file SFI 


M/0 


1 byte 


13 


ADN file Record Identifier 


M/0 


1 byte 



Additional Number Identifier 
Content: 

describes the type of the additional number defined in the file EFaas- 
Coding: 

'00' - no additional number description; 

'xx' - record number in EFaas describing the type of number (e.g. "FAX"); 

'FF' - free record. 

Additional number 
Content: 

additional phone number linked to the phone book entry. 
Coding: 

same than the dialUng number /SSC string in EFadn 

- ADN file SFI 
Content: 

Short File identifier of the associated EFadn file- 
Coding: 

as defined in the UICC specification. 

- ADN file Record Identifier 
Content: 

record identifier of the associated phone book entry. 
Coding: 

'xx' - record identifier of the corresponding ADN record 

In case of a one-to-one mapping, i.e. there is one ANR entry for each ADN entry, the ADN file SFI and the ADN file 
Record Identifier should not be present. In all other cases these two bytes shall be present. 

4.4.2.1 EFsNE (Second Name Entry) 

The phone book also contains the option of a second name entry. The second name entry is associated with the ADN 
record through the pointer in the index administration file. The amount of second name entries may be less than or equal 
to the amount of records in EFadn- 
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Structure of EFsne 



Identifier: '4FXX' 


Structure: linear fixed Optional 


SFI: mandatory 




Record length: X+2 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 toX 


Alpha Identifier of Second Name 


M 


X bytes 


X+1 


ADN file SFI 


M/0 


1 byte 


X+2 


ADN file Record Identifier 


M/0 


1 byte 



Alpha Identifier of Second Name 
Content: 

string defining the second name of the phone book entry. 
Coding: 

as the alpha identifier for EFadn- 

- ADN file SFI 
Content: 

Short File identifier of the associated EFadn file. 
Coding: 

as defined in the UICC specification. 

- ADN file Record Identifier 
Content: 

record identifier of the associated phone book entry. 
Coding: 

'xx' - record identifier of the corresponding ADN record. 

In case of a one-to-one mapping, i.e. there is one SNE entry for each ADN entry, the ADN file SFI and the ADN file 
Record Identifier should not be present. In all other cases these two bytes shall be present. 

4.4.2.1 1 EFccpi (Capability Configuration Parameters 1) 

This EF contains parameters of required network and bearer capabilities and ME configurations associated with a call 
established using a phone book entry. 



Identifier: '4F3D' 


Structure: linear fixed Optional 


SFI: optional 




Record length: 14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 10 


Bearer capability information element 


M 


1 bytes 


11 to 14 


Bytes reserved - see below 


M 


4 bytes 



Bearer capability information element 
Contents and Coding: 

see 3G TS 24.008 [9]. The Information Element Identity (lEI) shall be excluded; i.e. the first byte of the 

EFccp record shall be Length of the bearer capability contents. 
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Bytes 1 1-14 shall be set to 'FF' and shall not be interpreted by the ME. 

4.4.2.12 Phone Book Synchronisation 

To support synchronisation of phone book data with other devices, the USIM may provide following identifiers to be 
used by the synchronisation method: a phone book synchronisation counter (PSC), a unique identifier for each phone 
book entry (UID) and change counter (CC) to indicate recent changes. 

When the 3G UICC has been inserted into a 2G terminal and a record in the phone book has been updated, a flag in the 
entry control information in the EFpBc is set from to 1 by the card. When/if the UICC later is inserted into a 3G 
terminal again, the terminal shall check the flag in EFpBc and if this flag is set update the CC. A set flag in EFpBc results 
in a full synchronisation of the phone book (if synchronisation is requested). 



4.4.2.12.1 



EFuiD (Unique Identifier) 



The UID is used to uniquely identify a record and to be able to keep track of the records in the phonebook.. The 
terminal assigns the (UID) when a new entry is created. The value of the UID does not change as long as the value of 
the PID remains the same. The UID shall remain on the UICC, in EFmo, until the FID is regenerated. This means that 
when a record is deleted from the phonebook, the content of the linked information (eg ADN, E-MAIL,..) are set to the 
personalisation value 'FF. . .FF'. But the UID-value of the deleted record shall not be used when a new record is added to 
the phonebook until the PID is regenerated, but it shall be set to a new value. 

If/when the PID is regenerated, all UIDs for the records in the phonebook shall be assigned new values starting from 1. 
The new value of the UID for each record shall then be kept until the PID is regenerated again. 



Structure of EF 



UID 



Identifier: '4F21' 


Structure: linear fixed Optional 


SFI: optional 




Record lengtli: 2 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Lengtli 


1 to 2 


Unique Identifier (UID) of Phone Bool< Entry 


M 


2 bytes 



Unique Identifier of Phone Book Entry 
Content: 

number to unambiguously identify the phone book entry for synchronisation purposes. 
Coding: 

hexadecimal. At initialisation all UIDs are personalised to 0000 Hex (e.g. empty). 



4.4.2.12.2 



EFpsc (Phone book Synchronisation Counter) 



The phone book synchronisation counter (PSC) is used by the ME to construct the phone book identifier and to 
determine whether the accessed phone book is the same as the previously accessed phone book or if it is a new 
unknown phone book (might be the case that there is one phonebook under DF-telecom and one phonebook residing in 
a USIM-application). If the PSC is unknown, a full synchronisation of the phonebook will follow. 

The PSC is also used to regenerate the UIDs and reset the CC to prevent them from running out of range. When the 
UIDs or the CC has reached its maximum value, a new PSC is generated. This leads to a scenario where neither the CC 
nor the UIDs will run out of range. 

The PSC shall be regenerated by the terminal if one of the following situation applies: 
the values of the UIDs have run out of range; 
the whole phone book has been reset/deleted; 
- the value of the CC has run out of range. 
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Structure of EFpsc 



Identifier: '4F22' 


Structure 


transparent Optional 


SFI: optional 




File size: 4 


bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 




Bytes 


Description 


M/0 


Length 


1 to 4 


Phone book synchronisation counter (PSC) 


M 


4 bytes 



PSC: Unique synchronisation counter of Phone Book 
Content: 

number to unambiguously identify the status of the phone book for synchronisation purposes 
Coding: 

hexadecimal. 

The phone book identifier coding based on the EFpsc is described hereafter : 

For a phone book residing in DF-telecom: 

Phone book identifier = ICCid (lObytes) "fixed part" + 4 bytes (in EFpsc) "variable part" 

For a phone book residing in an USIM application: 

- Phone book identifier = 10 last bytes of (ICCid XOR AID) "fixed part" + 4 bytes (in EFpsc) "variable 
part" 

To be able to detect if the PSC needs to be regenerated (i.e. the variable part) the following test must be made by 
the terminal before for each update of either the CC or the assignment of a new UID: 

Each time the terminal has to increment the value of the UID the following test is needed: 

IfUID = FFFFthen 

{Increment PSC mod FFFFFFFF ; } 

Each time the terminal has to increment the value of CC the following test is needed: 

IfCC = FFFFthen 

{Increment PSC mod FFFFFFFF ; CC=0001 } 

NOTE: If the phonebook is deleted then the terminal will change the PSC according to: 

Incrementing PSC modulus FFFFFFFF 



4.4.2.12.3 



EFcc (Change Counter) 



The change counter (CC) shall be used to detect changes made to the phone book. 

Every update/deletion of an existing phone book entry or the addition of a new phone book entry causes the terminal to 
increment the CC. The concept of having a CC makes it possible to update the phonebook in different terminals, which 
still are able to detect the changes (e.g. changes between different handset and/or 2""* and 3'^'' generation of terminals). 
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Structure of EFcc 



Identifier: '4F23' 


Structure: transparent Optional 


SFI: Mandatory 




File size: 2 


bytes 


Update activity: high 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
PIN 
ADM 
ADM 


Bytes 


Description 


M/0 


Length 


1 to 2 


Cliange Counter (CC) of Phone Bool< 


M 


2 bytes 



Change Counter of Phone Book 
Content: 

indicates recent change(s) to phone book entries for synchronisation purposes. 
Coding: 

hexadecimal, at initialisation, CC shall be personalised to OOOOHex (i.e. empty). 



4.4.2.12.4 



EFpuiD (Previous Unique Identifier) 



Ttie PUID is used to store the previously used unique identifier (UID). The purpose of this file is to allow the terminal to quickly 
generate a new UID, which shall than be stored in the PUID. 

Structure of EFpuio 



Identifier: '4F24' 


Structure: transparent Optional 


SFI: Mandatory 




File size: 2 bytes Update activity: high 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 2 


Previous Change Counter (CC) of Phone Bool< 


M 


2 bytes 



Previously unique Identifier of Phone Book Entry 
Content: 

previous number that was used to unambiguously identify the phone book entry for synchronisation 

purposes. 



4.5 



Contents of files at the TELECOM level 



The EFs in the Dedicated File DF-pelecom contain service related information. 

4.5.1 EFadn (Abbreviated dialling numbers) 

In case of a present GSM application on the UICC the first EFadn (ic- reflected by the first record in EFpbr ) of the 
DFpHONEBooK is mapped to DFxelecom to ensure backwards compatibility. 

A 3G ME shall not access this file. The information is accessible for a 3G ME under in EFadn under DFphonebook. 
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4.5.2 EFexti (Extensioni) 

In case of a present GSM application on the UICC the first EFbxti (ie. reflected by the first record in EFpbr ) of the 
DFpHONEBooK is mapped to DFxelecom to ensure backwards compatibility. 

4.5.3 EFccp (Capability Configuration Parameter) 

In case of a present GSM application on the UICC the first EFccp (ie. reflected by the first record in EFpbr ) of the 
DFpHONEBooK is mapped to DFtelecom to ensure backwards compatibility. 

4.5.4 EFsuME (SetUpMenu Elements) 

This EF contains Simple TLVs related to the menu title to be used by a UICC when issuing a SET UP MENU proactive 
command. 



Identifier: '6F54' 


Structure 


transparent 


Optional 


File size: X+Y 


bytes 


Update activity 


: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 


ADM 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 -X 


Title Alpha Identifier 


M 


X bytes 


1 +x - X+Y 


Title Icon Identifier 





Y bytes 



Title Alpha Identifier 
Contents: 

this field contains the Alpha Identifier Simple TLV defining the menu title text. 
Coding: 

according to TS 31.111 [12]. 

Title Icon Identifier 
Contents: 

this field contains the Icon Identifier Simple TLV defining the menu title icon. 
Coding: 

according to TS 3 1 . 1 1 1 [ 12] . If not present the field shall be set to 'FF'. 

Unused bytes of this file shall be set to 'FF'. 



4.6 



Contents of DFs at the TELECOM level 



DFs may be present as child directories of DFxelecom- The following DFs have been defined: 
- DFgraphics '5F50' 

DFpHONEBOOK '5F3A' 

(DF for public phone book. This DF has the same structure as DFphonebook under ADF USIM) 

4.6.1 Contents of files at the DFqraphics level 

The EFs in the Dedicated File DFgraphics contain graphical information. 

4.6.1.1 EFiMG (Image) 

Each record of this EF identifies instances of one particular graphical image, which graphical image is identified by this 
EF's record number. 
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Image instances may differ as to their size, having different resolutions, and the way they are coded, using one of 
several image coding schemes. 

As an example, image k may represent a company logo, of which there are i instances in the UICC, of various 
resolutions and perhaps encoded in several image coding schemes. Then, the i instances of the company's logo are 
described in record k of this EF. 



Identifier: '4F20' Structure: linear fixed Optional 


Record length: 9n+2 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE ADM 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 


Number of Actual Image Instances 


M 


1 byte 


2 to 10 


Descriptor of Image Instance 1 


M 


9 bytes 


11 to 19 


Descriptor of Image Instance 2 





9 bytes 










9{n-1) + 2to 
9n + 1 


Descriptor of Image Instance n 





9 bytes 


9n + 2 


RFU (see 3GTS 31.101) 





1 byte 



Number of Actual Image Instances 
Contents: 

this byte gives the number of actual image instances described in the following data items (i.e. unused 

descriptors are not counted). 
Coding: 

binary. 

Image Instance Descriptor 
Contents: 

a description of an image instance. 
Coding: 

Byte 1 : Image Instance Width 
Contents: 

this byte specifies the image instance width, expressed in raster image points. 
Coding: 
binary. 

Byte 2: Image Instance Height 
Contents: 

this byte specifies the image instance height, expressed in raster image points. 
Coding: 

binary. 

Byte 3: Image Coding Scheme 
Contents: 

this byte identifies the image coding scheme that has been used in encoding the image instance. 
Coding: 

'11'- basic image coding scheme as defined in annex B; 

'21' - colour image coding scheme as defined in annex B; 

other values are reserved for future use. 

Bytes 4 and 5: Image Instance File Identifier 
Contents: 

these bytes identify an EF which is the image instance data file (see subclause 4.6.1.2), holding the 

actual image data for this particular instance. 
Coding: 

byte 4: high byte of Image Instance File Identifier; 

byte 5: low byte of Image Instance File Identifier. 
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Bytes 6 and 7: Offset into Image Instance File 
Contents; 

these bytes specify an offset into the transparent Image Instance File identified in bytes 4 and 5. 
Coding: 

byte 6: high byte of offset into Image Instance File; 

byte 7; low byte of offset into Image Instance File 

Bytes 8 and 9; Length of Image Instance Data 
Contents; 

these bytes yield the length of the image instance data, starting at the offset identified in bytes 6 and 7. 
Coding; 

byte 8; high byte of Image Instance Data length; 

byte 9; low byte of Image Instance Data length. 

NOTE; Transparent image instance data longer than 256 bytes may be read using successive READ BINARY 
commands. 

4.6.1 .2 Image Instance Data Files 

Residing under DFgraphics, there may be several image instance data files. These EFs containing image instance data 
shall have the following attributes; 



Identifier: '4FXX' 




Structure 


transparent 


Optional 


Record length: 


Y bytes 




Update activity: low 


Access Conditions: 
READ 
UPDATE 
DEACTIVATE 
ACTIVATE 




PIN 
ADM 
ADM 
ADM 






Bytes 


Description 


M/0 


Length 


1 toY 


Image Instance Data 


M 


Y bytes 



Contents and coding; 

Image instance data are accessed using the image instance descriptors provided by EFimg (see subclause 4.6.1.1). 

The identifier '4FXX' shall be different from one image instance data file to the other. For the range of 'XX', see 
subclause ??. The length Y may be different from one image instance data file to the other. 

4.6.2 Contents of files at the DFrhonebook under the DFtelecom 

4.6.3 EFccp (Capability Configuration Parameters) 

This EF contains parameters of required GSM network and GSM bearer capabilities and terminal configurations 
associated with a call established using an abbreviated dialling number, a fixed dialling number, an MSISDN, a last 
number dialled, a service dialling number or a barred dialling number. This EF can be referred to by EFs at the 
DFpHONEBooK under DF-pelecom- 
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Identifier: '4F3D' 


Structure: linear fixed Optional 


SFI: optional 




Record length: 14 bytes Update activity: low 


Access Conditions: 

READ PIN 
UPDATE PIN 
DEACTIVATE ADM 
ACTIVATE ADM 


Bytes 


Description 


M/0 


Length 


1 to 10 


Bearer capability information element 


M 


10 bytes 


11 to 14 


Bytes reserved - see below 


M 


4 bytes 



Bearer capability information element 
Contents and Coding: 

see 3G TS 24.008 and GSM 24.008 [9]. The Information Element Identity (lEI) shall be excluded, i.e. the 

first byte of the EFccp record shall be Length of the bearer capability contents. 

Bytes 1 1-14 shall be set to 'FF' and shall not be interpreted by the ME. 



4.7 



Files of USIM 



This subclause contains a figure depicting the file structure of the UICC and the ADFusim- ADFusim shall be selected 
using the AID and information in EFdir. 
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MF 
'3F00' 



DFqsm 
'7F20' 



DF. 



TELECOM 

7F10' 



see GSM 
11.11 [18 



EFftoN 
' 6F3A' 



EFsMsp 
' 5F42' 



EFexti 
' 6F4A' 



EFsuME 

' 6F54 ' 



DFgr^phics 
'5F50' 



EFjMG 

'4F20' 



DF 



PHONEBOOK 

5F3A' 



EFpBR 
'4F30' 



EFqrp 
' 4FXX' 



EFccpi 
'4F3D' 



EFoiR 
'2F00' 



EFpDH 

' 6F3B' 



EFsMs 
' 6F3C' 



EFgMss 
' 6F43' 



EFlhd 
r 6F44' 



EFexi 
' 6F4I 



EFext3 

' 6F4C' 



EFjftP 
' 4FXX' 



EF^uvs 
' 4FXX' 



EFjiDN 

' 4FXX' 



EFgas 
'4FXX' 



EFjcciD 
'2FE2 ' 



EFccp 
' 6F3D' 



EFgMSR 

' 6F47 ' 



EFppN 
' 6F4D' 



EFexti 
' 4FXX' 



EFftNR 
' 4FXX' 



EFpL 
'2F05' 



EF 



MSISDN 

6F40' 



EFsoH 
'6F49' 



EFext4 

'6F4E' 



EFpBc 
'4FXX' 



EFsHE 

' 4FXX' 



EFuiD 
'4F21' 



EFpsc 
'4F22 ' 



EFcc 
'4F23' 



EFpmo 
'4F24 ' 



Figure 4.1 : File identifiers and directory structures of UICC 
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DFus 



DF 



PHONEBOOK 

5F3A' 



EFpBR 
'4F30' 



EFiftP 
' 4FXX' 



EFjoN 
'4FXX' 



EFqp_p 
' 4FXX' 



FF^^s 
' 4FXX' 



'4FXX' 



FFqcpi 
'4F3D' 



EFuiD 
'4F21' 



EFpsc 
'4F22 ' 



EFcc 
'4F23' 



DFsoLSA 

'5F70' 



EFgai 
'4F30' 



EFysT 
'6F38' 



EFexti 
' 4FXX' 



EFftNR 
' 4FXX' 



EFpoio 
'4F24 ' 



EFsLL 

'4F31' 



EFpBc 
'4FXX' 



EFsNE 

' 4FXX' 



EFli 
6F05' 



EF 



IMSI 

6F07 ' 



EF, 



MSISDN 

6F40' 



EF^cc 
' 6F78' 



EF 



Keys 

6F08' 



EF 



KeysPS 

6F09' 



EF^CM 
' 6F39' 



EF^CMmax 

'6F37' 



EFpucT 
' 6F41' 



EFgipi 
' 6F3E' 



EFgpd2 

' 6F3F' 



EFspN 
' 6F46' 



EFpLMNsel 

' 6F30 ' 



EFhplmn 
' 6F31' 



EFppLMN 

' 6F7B' 



EFftP 
6FAD ' 



EFjppi 
' 6FAE ' 



EFgmsi 
' 6FC2' 



EFecc 
'6FB7' 



EFccp 
'4F3D' 



EFsDH 

' 5F49' 



EFpoH 
' 6F3B' 



EFext2 

' 6F4B' 



EFpxTS 
'6F4C' 



EFcBMI 

' 6F45' 



EFcBMID 

' 6F48' 



EFcBMIR 

'6F50' 



EFpxTS 
' 6F4E' 



EFHiddenkey 

'6FC3' 



EFloci 
' 6F7E' 



EFpocips 
'6F53' 



EFjci 
'6F80' 



EFqci 
' 6F81 ' 



EFjcT 
' 6F82 ' 



EFqct 
' 6F83' 



EFeMLPP 

' 6FB5' 



EF^aeM 

' 6FB6' 



EFlocI2G 

' 6F7F' 



EFkc 
' 6F20' 



EF 



KcGPRS 

5F52' 



EF 



LOG I GPRS 

6F53' 



EFsMs 
'6F3C' 



EFgMSP 

' 6F42 ' 



EFsMss 
' 6F43' 



EFsMSR 
' 6F47' 



EFpcGH 

' 6F74' 



Figure 4.2: File identifiers and directory structures of USIM 
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Application protocol 



When involved in 3G administrative management operations, the USIM interfaces with appropriate equipment. These 
operations are outside the scope of this standard. 

When involved in 3G network operations the USIM interfaces with an ME with which messages are exchanged. A 
message can be a command or a response. 

a USIM Application command/response pair is a sequence consisting of a command and the associated 
response. 

a USIM Application procedure consists of one or more USIM Application command/response pairs which 
are used to perform all or part of an application-oriented task. A procedure shall be considered as a whole, 
that is to say that the corresponding task is achieved if and only if the procedure is completed. The ME shall 
ensure that, when operated according to the manufacturer's manual, any unspecified interruption of the 
sequence of command/response pairs which realise the procedure, leads to the abortion of the procedure 
itself. 

a 3G session of the USIM in the 3G application is the interval of time starting at the completion of the USIM 
initialisation procedure and ending either with the start of the 3G session termination procedure, or at the first 
instant the link between the UICC and the ME is interrupted. 

During the 3G network operation phase, the ME plays the role of the master and the USIM plays the role of the slave. 

The USIM shall execute all 3G and USIM Application Toolkit commands or procedures in such a way as not to 
jeopardise, or cause suspension, of service provisioning to the user. This could occur if, for example, execution of the 
AUTHENTICATE is delayed in such a way which would result in the network denying or suspending service to the 
user. 

The procedures listed in subclause "USIM management procedures" are required for execution of the procedures in the 
subsequent subclauses "USIM security related procedures" and "Subscription related procedures". The procedures listed 
in subclauses "USIM security related procedures" are mandatory. The procedures listed in "Subscription related 
procedures" are only executable if the associated services, which are optional, are provided in the USIM. However, if 
the procedures are implemented, it shall be in accordance with subclause "Subscription related procedures". 

If a procedure is related to a specific service indicated in the USIM Service Table, it shall only be executed if the 
corresponding bits denote this service as "service available" (see subclause "EFust")- In all other cases the procedure 
shall not start. 

5.1 USIM management procedures 
5.1.1 USIM initialisation 

After UICC activation (see 3G TS 31.101 [11]), the ME selects a USIM appHcation. If no EFdir file is found or no 
USIM applications are listed in the EFojr file, the ME then tries to select the GSM application as specified in GSM 
11.11 [18]. 

The ME optionally attempts to select EFecc- If EFecc is available, the ME requests the emergency call codes. 

The ME requests the Language Indication. The ME keeps using the language selected during UICC activation by means 
of EFpL (see 3G TS 31.101 [11]) if at least one of the following conditions holds: 

EFli is not available; 

EFli does not contain an entry corresponding to a language specified in ISO 639[19]; 

the ME does not support any of the languages in EFli. 

If none of the languages in the EFs is supported then the ME selects a default language. 

The ME then runs the PIN verification procedure. If the PIN verification procedure is performed successfully, the ME 
then runs the application profile indication request procedure. 

The ME performs the administrative information request. 
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The ME performs the USIM Service Table request. 

For a USIM appHcation requiring PROFILE DOWNLOAD, the ME shall perform the PROFILE DOWNLOAD 
procedure in accordance with 3G TS 3 L 1 1 1 [ 12] . 

If the FDN service is available the ME shall perform the following procedure. The procedure is tbd. 

If all these procedures have been performed successfully then 3G session shall start. In all other cases 3G session shall 
not start. 

Afterwards, the ME runs the following procedures: 

IMSI request; 

Access control information request; 
HPLMN search period request; 
PLMN selector request; 
Location Information request; 
Cipher key and integrity key request; 
Forbidden PLMN request; 
LSA information request; 

- CBMID request; 

depending on the further services that are supported by both the ME and the USIM the corresponding EFs 
have to be read. 

After the USIM initialisation has been completed successfully, the ME is ready for a 3G session and indicates this to the 
USIM be sending a particular STATUS command. 

5.1 .2 3G session termination 

NOTE 1: This procedure is not to be confused with the deactivation procedure in 3G TS 31.101 [11]. 

The 3G session is terminated by the ME as follows. 

The ME runs all the procedures which are necessary to transfer the following subscriber related information to the 
USIM: 

- Location Information update; 
Cipher Key and Integrity Key update; 
Advice of Charge increase; 

- Forbidden PLMN update. 

As soon as the USIM indicates that these procedures are completed, the ME sends a particular STATUS command 
indicating the termination of the 3G session. 

Finally, the ME deletes all these subscriber related information elements from its memory. 

NOTE 2: If the ME has already updated any of the subscriber related information during the 3G session, and the 
value has not changed until 3G session termination, the ME may omit the respective update procedure. 

5.1 .3 USIM application closure 

After termination of the 3G session as defined in 5.1.2 the USIM application may be closed by closing the logical 
channels that are used to communicate with this particular USIM application. 

5. 1 .4 Emergency call codes 

Request: The ME performs the reading procedure with EFecc- 

Update: The ME performs the updating procedure with EFecc- 

NOTE: The update procedure is only applicable when access conditions of ADM for update is set to ALW, PIN 
or PIN2. 
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5.1.5 Language indication 

Request: The ME performs the reading procedure with EFli. 

Update: The ME performs the updating procedure with EFli. 

5.1 .6 Administrative information request 

The ME performs the reading procedure with EFad- 

5.1 .7 USIM service table request 

The ME performs the reading procedure with EFust- 

5.1 .8 Application profile indication request 

The ME performs the reading procedure with EFappi- 

5.1 .9 UICC presence detection 

The ME checks for the presence oftheUICC according to 3GTS 31.101 [11] . 

5.2 USIM security related procedures 

5.2.1 Authentication algorithms computation 

The ME selects a USIM application and uses the INTERNAL AUTHENTICATE command (see 7.1.1). The response is 
sent to the ME (in case of the T=0 protocol when requested by a subsequent GET RESPONSE command). 

5.2.2 IMSI request 

The ME performs the reading procedure with EFimsi. 

5.2.3 Access control information request 

The ME performs the reading procedure with EFacc. 

5.2.4 HPLMN search period request 

The ME performs the reading procedure with EFhplmn. 

5.2.5 Location information 

Request: The ME performs the reading procedure with EFloci. 

Update: The ME performs the updating procedure with EFloci- 

In the case when updating EFloci with data containing the TMSI value and the card reports the error '92 40' (Memory 
Problem), the ME shall terminate 3G operation. 

5.2.6 Cipher and Integrity key 

Request: The ME performs the reading procedure with EFKeys. 

Update: The ME performs the updating procedure with EFKeys. 
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5.2.7 Forbidden PLMN 

Request: The ME performs the reading procedure with EFpplmn- 

Update: The ME performs the updating procedure with EFpplmn- 

5.2.8 LSA information 



Request: 
Update: 



The ME performs the reading procedure with EFsai, EFsll and its associated LSA Descriptor files. 
The ME performs the updating procedure with EFsll- 



5.2.9 User Identity Request 



The ME selects a USIM and checks service no. 26 (Enhanced user identity confidentiality). If service no. 26 is not 
available then the ME performs the reading procedure with EFimsi- 

Otherwise the ME uses the Encipher IMSI function (see 7.2. 1). The response is received by the ME (in case of the T=0 
protocol when requested by a subsequent GET RESPONSE command). Then the ME reads the group identity out of 
EFgmsi- The ME concatenates the HE-id, the group identity GMSI and the enciphered IMSI and sends that to the 
network. 



5.2.10 GSM Ciplner l<ey 



Request: 
Update: 



The ME performs the reading procedure with EFkc. 
The ME performs the updating procedure with EFkc. 



5.3 Subscription related procedures 
5.3.1 Phone book procedures 



5.3.1.1 



Initialisation 



The ME first reads the content of EFpbr to determine the configuration phonebook. If the EFiap file is indicated in 
EFpBR following tag 'D8' the ME reads the content of EFiap in order to establish the relation ship between the content in 
the files indicated using tag 'D9' and files indicated by tag 'D8'. The ME may read the contents of the phone book 
related files in any order. 

5.3.1 .2 Creation/Deletion of information 

In order to avoid unlinked data to introduce fragmentation of the files containing phone book data the following 
procedures shall be followed when creating a new entry in the phone book. The data related to EFadn is first stored in 
the relevant record. As the record number is used as a pointer the reference pointer is now defined for the entry. The 
rule for storing additional information for an entry is that the reference pointer shall be created before the actual data is 
written to the location. 

In case of deletion of a complete or part of an entry the data shall be deleted first followed by the reference pointer for 
that data element. In case of deletion of a complete entry the contents of EFadn is the last to be deleted. 



5.3.1 .3 Hidden phone book entries 

If a phone book entry is marked as hidden by means of EFpBc the ME first prompts the user to enter the 'Hidden Key'. 
The key presented by the user is compared against the value that is stored in the corresponding EFniddenkey - Only if the 
presented and stored hidden key are identical the ME displays the data stored in this phone book entry. Otherwise the 
content of this phone book entry is not diplayed by the ME. 



Request: 
Update: 



The ME performs the reading procedure with EFniddenkey- 
The ME performs the updating procedure with EFniddenkey- 
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5.3.2 Dialling numbers 

The following procedures may not only be applied to EFadn and its associated extension files EFccp and EFexti as 
described in the procedures below, but also to EFfdn^ EFmsisdn^ EFl^d, EFbdn and EFsdn and their associated extension 
files. If these files are not allocated and activated, as denoted in the USIM service table, the current procedure shall be 
aborted and the appropriate EFs shall remain unchanged. 

As an example, the following procedures are described as applied to ADN. 

Requirement: Service n°2 "allocated and activated" 

(Service n°3 for FDN, 
Service n°9 for MSISDN, 
Service n°13 for END, 
Service n° 18 for SDN), 
Service n°31 for BDN). 

Update: The ME analyses and assembles the information to be stored as follows (the byte identifiers used 

below correspond to those in the definition of the relevant EFs in the present document): 

i) The ME identifies the Alpha-tagging, Capability/Configuration Identifier and Extension! Record Identifier. 

ii) The dialling number/SSC string shall be analysed and allocated to the bytes of the EF as follows: 

if a "+" is found, the TON identifier is set to "International"; 

if 20 or less "digits" remain, they shall form the dialling number/SSC string; 

if more than 20 "digits" remain, the procedure shall be as follows: 

Requirement: 

Service n°10 "allocated and activated" 

(Service n°10 appHes also for MSISDN and END; 

Service n° 11 for FDN; 

Service n°19 for SDN; 

Service n°32 for BDN.) 

The ME seeks for a free record in EFexti- If an Extension! record is not marked as "free", the ME runs the 
Purge procedure. If an Extension! record is still unavailable, the procedure is aborted. 

The first 20 "digits" are stored in the dialling number/SSC string. The value of the length of BCD 
number/SSC contents is set to the maximum value, which is 1 1. The Extension! record identifier is coded 
with the associated record number in the EFexti- The remaining digits are stored in the selected Extension! 
record where the type of the record is set to "additional data". The first byte of the Extension! record is set 
with the number of bytes of the remaining additional data. The number of bytes containing digit information 
is the sum of the length of BCD number/SSC contents of EFadn and byte 2 of all associated chained 
Extension! records containing additional data. 

iii) If a called party subaddress is associated to the ADN/SSC the procedure shall proceed as follows: 

Requirement: 

Service n°!0 "allocated and activated" 

(Service n°!0 appHes also for MSISDN and END; 

Service n°!l for FDN; 

Service n°19 for SDN; 

Service n°32 for BDN.) 

If the length of the called party subaddress is less than or equal to ! ! bytes (see 3G TS 24.008 [9] for 
coding): 

The ME seeks for a free record in EFexti- If an Extension! record is not marked as "free", the ME runs the 
Purge procedure. If an Extension! record is still unavailable, the procedure is aborted. 

The ME stores the called party subaddress in the Extension! record, and sets the Extension! record type to 
"called party subaddress". 
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If the length of the called party subaddress is greater than 1 1 bytes (see 3G TS 24.008 [9] for coding): 

The ME seeks for two free records in EFexti- If no such two records are found, the ME runs the Purge 
procedure. If two Extensionl records are still unavailable, the procedure is aborted. 

The ME stores the called party subaddress in the two Extensionl records. The identifier field in the 
Extensionl record containing the first part of the subaddress data is coded with the associated EFexti record 
number containing the second part of the subaddress data. Both Extensionl record types are set to "called 
party subaddress". 

Once i), ii), and iii) have been considered the ME performs the updating procedure with EFadn- If the USIM has no 
available empty space to store the received ADN/SSC, or if the procedure has been aborted, the ME advises the user. 

For reasons of memory efficiency, the ME may analyse all Extensionl records to recognie if the additional or 
subaddress data to be stored is already existing in EFexti- In this case, the ME may use the existing chain or the last part 
of the existing chain from more than one ADN (LND, MSISDN). The ME is only allowed to store extension data in 
unused records. If existing records are used for multiple access, the ME shall not change any data in those records to 
prevent corruption of existing chains. 

Erasure: The ME sends the identification of the information to be erased. The content of the identified 

record in EFadn is marked as "free". 

Request: The ME sends the identification of the information to be read. The ME shall analyse the data of 

EFadn to ascertain, whether additional data is associated in EFexti or EFccp- If necessary, then the 
ME performs the reading procedure on these EFs to assemble the complete ADN/SSC. 

Purge: The ME shall access each EF which references EFexti (EFext2) for storage and shall identify 

records in these files using extension data (additional data or called party subaddress). Note that 
existing chains have to be followed to the end. All referred Extensionl (Extension2) records are 
noted by the ME. All Extensionl (Extension2) records not noted are then marked by the ME as 
"free" by setting the whole record to 'FF'. 

NOTE 2: Dependent upon the implementation of the ME, and in particular the possibility of erasure of ADN/SSC 
records by Phase 1 MEs, which have no knowledge of the EFexti^ it is possible for Extensionl records to 
be marked as "used space" (not equal to 'FF'), although in fact they are no longer associated with an 
ADN/SSC record. 

The following three procedures are only applicable to service n°3 (FDN). 

FDN capability request. The ME has to check the state of service n°2, i.e. if FDN is "available". BDN capability 
request. The ME has to check the state of service n°7, i.e. if BDN is "available ". 



5.3.3 Short messages 



Requirement: 
Request: 



Update: 



Erasure: 



Service n° 10 "available". 

The USIM seeks for the identified short message. If this message is found, the ME performs the 
reading procedure with EFsms- 

If service n° 10 is "available" and the status of the SMS is 'ID' (status report requested, received 
and stored in EFsmsr), the ME performs the reading procedure with the corresponding record in 
EFsMSR- If the ME does not find a corresponding record in EFsmsr^ then the ME shall update the 
status of the SMS with '19' (status report requested, received but not stored in EFsmsr)- 

If the short message is not found within the USIM memory, the USIM indicates that to the ME. 

The ME looks for the next available area to store the short message. If such an area is available, it 
performs the updating procedure with EFsms- 

If there is no available empty space in the USIM to store the received short message, a specific 
MMI will have to take place in order not to loose the message. 

The ME will select in the USIM the message area to be erased. Depending on the MMI, the 
message may be read before the area is marked as "free". After performing the updating procedure 
with EFsMs^ the memory allocated to this short message in the USIM is made available for a new 
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incoming message. The memory of the USIM may still contain the old message until a new 
message is stored in this area. 

If service n°ll is "available" and the status of the SMS is 'ID' (status report requested, received 
and stored in EFsmsr), the ME performs the erasure procedure for EFsmsr with the corresponding 
record in EFsmsr- 

5.3.4 Advice of charge 

Requirement: Service n°13 "available". 

Accumulated Call Meter 

Request: The ME performs the reading procedure with EFacm- The USIM returns the last updated value of 

the ACM. 
Initialisation: The ME performs the updating procedure with EFacm using the new initial value. 

Increasing: The ME performs the increasing procedure with EFacm sending the value which has to be added. 

Accumulated Call Meter Maximum Value 

Request: The ME performs the reading procedure with EFACMmax- 

Initialisation: The ME performs the updating procedure with EpACMmax using the new initial maximum value. 

Price per Unit and Currency Table (PUCT) 

Request: The ME performs the reading procedure with EFpucT- 

Update: The ME performs the updating procedure with EFpucx- 

5.3.5 Capability configuration parameters 

Requirement: Service n°14 "available". 

Request: The ME performs the reading procedure with EFccp- 

Update: The ME performs the updating procedure with EFccp- 

Erasure: The ME sends the identification of the requested information to be erased. The content of the 

identified record in EFccp is marked as "free". 

5.3.6 PLMN selector 

Requirement: Service n°20 "available". 

Request: The ME performs the reading procedure with EFplmnsci- 

Update: The ME performs the updating procedure with EFplmnsci- 

5.3.7 Cell broadcast message identifier 

Requirement: Service n° 15 "available". 

Request: The ME performs the reading procedure with EFcbmi- 

Update: The ME performs the updating procedure with EFcbmi- 

5.3.8 Group identifier level 1 

Requirement: Service n°17 "available". 

Request: The ME performs the reading procedure with EFqidi. 

5.3.9 Group identifier level 2 

Requirement: Service n°18 "available". 

Request: The ME performs the reading procedure with EFcid2- 

5.3.10 Service provider name 

Requirement: Service n°19 "available". 

Request: The ME performs the reading procedure with EFspn- 
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5.3.1 1 Enhanced multi level precedence and pre-emption service 

Requirement: Service n°24 "available". 

Enhanced Multi Level Precedence and Pre-amption 

Request: The ME performs the reading procedure with EFeMLPP- 

Automatic Answer on eMLPP service 

Request: The ME performs the reading procedure with EFaaem- 

Update: The ME performs the updating procedure with EFaaem- 

5.3.12 Cell broadcast message identifier ranges 

Requirement: Service n°16 "available". 

Request: The ME performs the reading procedure with EFcbmir- 

Update: The ME performs the updating procedure with EFcbmir- 



5.3.13 Short message status report 



Requirement: 
Request: 

Update: 



Erasure: 



Purge: 



Service n° 11 "available". 

If the status of a stored short message indicates that there is a corresponding status report, the ME 
performs the search record function with EFsmsr to identify the record containing the appropriate 
status report. The ME performs the reading procedure with EFsmsr- 

If a status report is received, the ME first seeks within the SMS record identifiers of EFsmsr for 
the same record number it used for the short message in EFsms- If such a record identifier is found 
in EFsmsr, it is used for storage. If such a record identifier is not found, then the ME seeks for a 
free entry in EFsmsr for storage. If no free entry is found the ME runs the Purge procedure with 
EFsmsr- If there is still no free entry, the status report is not stored. 

If the ME found an appropriate record in EFsmsr for storage, it updates the record with the status 
report setting the record identifier in EFsmsr to the appropriate record number of the short message 
in EFsMs- 

The status in EFsms is updated accordingly by performing the update procedure with EFsms- 

The ME runs the update procedure with EFsmsr by at least storing '00' in the first byte of the 
record. The ME may optionally update the following bytes with 'FF'. 

The ME shall read the SMS record identifier (byte 1) of each record of EFsmsr- With each record 
the ME checks the corresponding short messages in EFsms- If the status (byte 1) of the 
corresponding SMS is not equal 'ID' (status report requested, received and stored in EFsmsr), the 
ME shall perform the erasure procedure with the appropriate record in EFsmsr- 



5.4 USAT related procedures 

5.4.1 Data Download via SMS-PP 

Requirement: USIM Service n°28 "available". 

The procedures and commands for Data Download via SMS-PP are defined in 3G TS 31.111 [12]. 

5.4.2 Image Request 

The terminal sends the identification of the information to be read. The terminal shall analyse the data of EFimg to 
identify the files containing the instances of the image. If necessary, then the terminal performs READ BINARY 
commands on these files to assemble the complete image instance data. 
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5.4.3 Data Download via SMS-CB 

Requirement: USIM Service n°29 "available". 

The ME shall perform the reading procedure with EFcbmid, and add the message identifiers to the Cell Broadcast search 
list. On receiving a cell broadcast message the procedure defined in 3G TS 31.111 [12] applies. 

5.4.4 Call Control by USIM 

Requirement: USIM Service n°30 "available". 

The procedures and commands for Call Control by USIM are defined in 3G TS 31.1 1 1 [12]. It is mandatory for the ME 
to perform the procedures if it has indicated that it supports Call Control by USIM in the TERMINAL PROFILE 
command. 

5.4.5 MO-SMS control by USIM 

Requirement: USIM Service n°3 1 "available". 

The procedures and commands for MO-SMS control by USIM are defined in 3G TS 31.1 1 1 [12]. It is mandatory for the 
ME to perform the procedures if it has indicated that it supports MO-SMS control by USIM in the TERMINAL 
PROFILE command. 



Security features 



The security aspects of 3G are specified in 3G TS 33.102 [13] and 3G TS 33.103 [14]. This clause gives information 
related to security features supported by the USIM to enable the following: 

authentication of the USIM to the network; 

authentication of the network to the USIM; 

authentication of the user to the USIM; 

data confidentiality over the radio interface; 

file access conditions; 

conversion functions to derive GSM parameters 

6.1 Authentication and key agreement procedure 

This subclause describes the authentication mechanism and cipher and integrity key generation which are invoked by 
the network. For the specification of the corresponding procedures across the USIM/ME interface see clause 5. 

The mechanism achieves mutual authentication by the user and the network showing knowledge of a secret key K 
which is shared between and available only to the USIM and the AuC in the user's HE. In addition, the USIM and the 
HE keep track of counters SEQms and SEQhe respectively to support network authentication. 

When the SNA'^LR initiates an authentication and key agreement, it selects the next authentication vector from the array 
and sends the parameters RAND and AUTN (authentication token) to the user. Each authentication token consists of the 
following components: a sequence number SQN, an Authentication Management Field (AMF) and a message 
authentication code MAC over the RAND, SQN and AMF. 

The USIM checks whether AUTN can be accepted and, if so, produces a response RES which is sent back to the 
SNA^LR. The SN/VLR compares the received RES with XRES. If they match the SN/VLR considers the authentication 
and key agreement exchange to be successfully completed. The USIM also computes CK and IK. The established keys 
CK and IK will be used by the ME to perform ciphering and integrity functions. 

A permanent secret key K is used in this procedure. This key K has a length of 128 bits and is stored within the USIM 
for use in the algorithms described below. Also more than one secret key K can be stored in the USIM. The active key 
to be used by the algorithms is signalled within the AMF field in the AUTN. 
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6.2 Cryptographic Functions 



The names and parameters of the cryptographic functions supported by the USIM are defined in 3G TS 33.102 [13]. 
These are: 

f 1 : a message authentication function for network authentication used to compute XMAC; 

fl *: a message authentication function for support to re-synchronisation with the property that no valuable 

information can be inferred from the function values of fl * about those of fl, ... , f5 and vice versa; 

f2: a message authentication function for user authentication used to compute SRES; 

G: a key generating function to compute the cipher key CK; 

f4: a key generating function to compute the integrity key IK; 

f5: a key generating function to compute the anonymity key AK (optional); 

f6: the user identity encryption function to encrypt the IMSl (optional). 

These cryptographic functions may exist either discretely or combined within the USIM. 



6.3 



GSIVI Conversion Functions 



To gain GSM access the USIM provides the conversion functions CI and C2. These functions derive the required GSM 
parameters (RANDg, SRES, cipher key Kc) from available 3G parameters. 



6.4 



File access conditions 



Every file has its own specific access condition for each command. The relevant access condition of the last selected 
file shall be fulfilled before the requested action can take place. 

For each file: 

the access conditions for the commands READ and SEARCH RECORD are identical; 
the access conditions for the commands SELECT and STATUS are ALWays. 

TBD: No file access conditions are currently assigned by 3G to the MP and the DFs. 

The access condition levels are defined in the following table: 

Table 6.1 : Access condition level coding 



Level 


Access Condition 





ALWays 


1 


PIN 


2 


PIN2 


3 


RFU 


4 to 14 


ADM 


15 


NEVer 



The meaning of the file access conditions is as follows: 

ALWAYS: The action can be performed without any restriction. 

PIN (Personal Identification Number): The action shall only be possible if one of the following three conditions 
is fulfilled: 

a correct PIN value has already been presented to the USIM during the current session; 
- TBD: the PIN enabled/disabled indicator is set to "disabled"; 

UNBLOCK PIN has been successfully performed during the current session. 

PIN2: The action shall only be possible if one of the following two conditions is fulfilled: 
a correct PIN2 value has already been presented to the USIM during the current session; 
UNBLOCK PIN2 has been successfully performed during the current session. 
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ADM: Allocation of these levels and the respective requirements for their fulfilment are the responsibility of the 
appropriate administrative authority. 

The definition of access condition ADM does not preclude the administrative authority from using ALW, PIN, 
PIN2 and NEV if required. 

NEVER: The action cannot be performed over the USIM(UICC)/ME interface. The USIM may perform the 
action internally. 

Condition levels are not hierarchical. For instance, correct presentation of PIN2 does not allow actions to be performed 
which require presentation of PIN. A condition level which has been satisfied remains valid until the end of the USIM 
session as long as the corresponding secret code remains unblocked, i.e. after three consecutive wrong attempts, not 
necessarily in the same application session, the access rights previously granted by this secret code are lost immediately. 
A satisfied PIN condition level applies to both ADFusim and DF-pelecom- 

TBD if applicable: The ME shall determine whether PIN2 is available by using the response to the STATUS command. 
If PIN2 is "not initialised" then PIN2 commands, e.g. VERIFY PIN2, shall not be executable. 



7 USIM Commands 

7.1 AUTHENTICATE 

7.1 .1 Command description 

The function is used during the procedure for authenticating the USIM to its HE and vice versa. In addition, a cipher 
key and an integrity key are calculated. For the execution of the command the USIM uses the subscriber authentication 
key K, which is stored in the USIM. 

The function is related to a particular USIM and shall not be executable unless the USIM or any sub-directory has been 
selected as the Current Directory and a successful PIN verification procedure has been performed (see clause 5). 

The function can be used in two different contexts: 

- a UMTS security context, when UMTS authentication vectors (RAND, CK, IK, AUTN) are available (i.e. the 
UE is located in the UMTS radio access network, or in a GSM radio access network which is connected to a 
UMTS or UMTS capable MSC/VLR or SGSN), or 

a GSM security context, when GSM authentication data are available only (i.e. the UE is located in the GSM 
radio access network which is connected to a non-UMTS capable MSC/VLR or SGSN). 

7.1.1.1 UMTS security context 

The USIM first computes the anonymity key AK = f5K (RAND) and retrieves the sequence number SQN = (SQN ® 
AK) e AK. 

Then the USIM computes XMAC = flK (SQN II RAND II AMF) and compares this with the MAC which is included in 
AUTN. If they are different, the USIM abandons the function. 

Next the USIM verifies that the received sequence number SQN is in the correct range. This is described in annex C.If 

the USIM detects the sequence numbers to be not in the correct range, this is considered as a synchronisation failure and 

the USIM abandons the function. In this case the command response is AUTS, where: 

AUTS = Conc(SEQMs ) II MACS; 

Conc(SEQMs) = SEQ^s ®f5K(MACS) is the concealed value of the counter SEQms in the USIM; and. 

MACS =fl*K(SEQMs II RAND II AMF) where: 

RAND is the random value received in the current user authentication request; 

the AMF assumes a dummy value of all zeroes so that it does not need to be transmitted in clear in the 

resynchronisation message. 
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If the sequence number is considered in the correct range, the USIM computes RES = Ok (RAND), the cipher key CK 
= Gk (RAND) and the integrity key IK = £4^ (RAND) and includes these in the command response. Note that if this is 
more efficient, RES, CK and IK could also be computed earlier at any time after receiving RAND. 

The use of AMP is HE specific and while processing the command, the content of the AMF has to be interpreted in the 
appropriate manner. The AMF may be used for support of multiple algorithms or keys, for changing the size of 
windows or lists, or for discriminating authentication vectors from separate CS/PS domains, see 3G TS 33.102 [13]. 

Next the USIM calculates the GSM response parameters SRES and Kc, using the conversion functions defined in 
3GTS 33.102 [13]. 

Input: 

- RAND, AUTN (AUTN := SQN ® AK II AMF II MAC). 
Output: 

- RES, CK, IK, SRES, Kc 
or 

AUTS. 

7.1 .1 .2 GSM security context 

The USIM computes RES = f2K (RAND), the cipher key CK = f3K (RAND) and the integrity key IK = f4K (RAND). 
Next the USIM calculates the GSM response parameters SRES and Kc, using the conversion functions defined in 

3GTS 33.102 [13]. 

Input: 

- RAND. 

Output: 

- SRES; Kc. 



7.1 .2 Command parameters and data 



Code 


Value 


OLA 


As specified in 3G TS 31.101 


INS 


'88' 


PI 


'00' 


P2 


See table below 


Lc 


See below 


Data 


See below 


Le 


See below 



Parameter P2 specifies the authentication context as follows: 



Coding of the reference control P2 



Coding 
bS-bl 


Meaning 


'1 ' 


Specific reference data (e.g. DF 
specific/application dependant key) 


' -XXXXXX- ' 


'000000' 


' X' 


Authentication context: 

GSM context 

1 UMTS context 



All other codings are RFU. 
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Command parameters/data: 



Byte(s) 


Description 


Length 


1 


Length of RAND (L1) 


1 


2 to (LI +1) 


RAND 


L1 


(L1+2) 


Length of AUTN (L2) (see note) 


1 


(LI +3) to 
(L1+L2+2) 


AUTN (see note) 


L2 


Note: Parameter present if and only if in UIVITS security context. 



The coding of AUTN is described in 3G TS 33.102 [13]. The most significant bit of RAND is coded on bit 8 of byte 2. 
The most significant bit of AUTN is coded on bit 8 of byte (Ll+3). 

Response parameters/data, case 1, UMTS security context, command successful: 



Byte(s) 


Description 


Length 


1 


"Successful UIVITS authentication" tag = 'DB' 


1 


2 


Length of RES (L3) 


1 


3 to (L3+2) 


RES 


L3 


(L3+3) 


Length of CK (L4) 


1 


(L3+4) to 
(L3+L4+3) 


CK 


L4 


(L3+L4+4) 


Length of IK (L5) 


1 


(L3+L4+5) to 
(L3+L4+L5+4) 


IK 


L5 


(L3+L4+L5+5) 


Length of SRES (= 4) 


1 


(L3+L4+L5+6) to 
(L3+L4+L5+10) 


SRES 


4 


(L3+L4+L5+11) 


Length of Kc (= 8) 


1 


(L3+L4+L5+12) 

to 
(L3+L4+L5+19) 


Kg 


8 



The most significant bit of RES is coded on bit 8 of byte 3. The most significant bit of CK is coded on bit 8 of byte 
(L3+4). The most significant bit of IK is coded on bit 8 of byte (L3+L4+5). 

Response parameters/data, case 2, UMTS security context, synchronisation failure: 



Byte(s) 


Description 


Length 


1 


"Synchronisation failure" tag = 'DC 


1 


2 


Length of AUTS(L1) 


1 


3 to (LI +2) 


AUTS 


L1 



The coding of AUTS is described in 3G TS 33.102 [13]. The most significant bit of AUTS is coded on bit 8 of byte 3. 
Response parameters/data, case 3, GSM security context, command successful: 
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Byte(s) 


Description 


Length 


1 


Length of SRES (= 4) 


1 


2 to 5 


SRES 


4 


6 


Length of Kc (= 8) 


1 


7 to 14 


Kc 


8 



The most significant bit of SRES is coded on bit 8 of byte 2. The most significant bit of Kc is coded on bit 8 of byte 7. 

7.2 Encipher IMSI 
7.2.1 Command description 

The function is used during the procedure for identification of the user via the radio access path by means of the 
enciphered permanent user identity (IMSI). 

For the execution of the command the USIM uses the group key GK and the sequence number SEQuic/ue which are 
stored internally in the USIM. 

The USIM increments the internal sequence number SEQuic/ue that holds the value from the last execution of 'Encipher 
IMSr. 

Next the USIM computes the enciphered IMSI as f6GK (SEQuic/ue H IMSI) which is then returned in the command 
response. 



The function is related to a particular USIM and shall not be executable unless the USIM or any sub-directory has been 
selected as the Current Directory and a successful PIN verification procedure has been performed (see clause 5). 

Input: 

none 
Output: 

enciphered IMSI. 



7.2.2 Command parameters and data 



Code 


Value 


CLA 


As defined in 3GTS 31.101 


INS 


'2A' 


P1 


'00' 


P2 


'00' 


Lc 


not present 


Data 


not present 


Le 


Length of EMS! (LI) 



Parameter Le specifies the expected length of the response. This is depending on the further specification of function f6. 
Command parameters/data: 

none 
Response parameters/data: 



Byte(s) 


Description 


Length 


1 


Length of encrypted MS\ (LI) 


1 


2 to (LI +1) 


Encrypted IIVISI 


LI 
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The most significant bit of the encrypted IMSI is coded on bit 8 of byte 2. 

7.3 Status Conditions Returned by the UICC 

Status of the card after processing of the command is coded in the status bytes SWl and SW2. This subclause specifies 
coding of the status bytes in the following tables. 

7.3.1 Security management 



SWl 


SW2 


Error description 


'98' 


'62' 


- Authentication error, incorrect MAC 
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7.3.2 Status Words of the Commands 

The following table shows for each command the possible status conditions returned (marked by an asterisk *). Status 
conditions of GSM and USIM applications are on the left and right sides of the table, respectively. 

Commands and status words 



> 

c 

H 

m 

H 
O 
> 

H 

m 


m 
o 

■D 

m 

i 








90 00 






91 XX 






9FXX 
61XX# 
93 00 
92 OX 






65 81 
94 00 
94 02 
94 04 


* 




94 08 
98 02 


* 


* 


69 82 
98 08 
98 10 
98 40 
98 50 


* 




98 62 


* 


* 


67 XX 




* 


6BXX 
6DXX 


* 


* 


6EXX 






6FXX 
62 81 
62 83 
62 82 
62 84 

62 00 

63 CX 
69 81 


* 


* 


69 84 






69 85 
69 86 
6A81 
6A82 
6A83 
6A84 
6A85 






6A86 
6A87 






6A88 
6CXX 
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Annex A (normative): 
Coding of USIIVI Specific Data 

A.1 SELECT Response Information 

Table A. 1 and A.2 of this annex describe how the response information of the SELECT command is coded in case of 
MP, DP, ADP and EP selection, respectively. 

Table A.I : SELECT Response Information in case of IVIF, ADF or DF 



Byte(s) 


Description 


Length 


1 to 2 


Total amount of memory of the selected directory which is 
not allocated to any of the DFs or EFs under the selected 
directory 


2 


3 to 4 


File ID 


2 


5 


Type of file (see subclause C.2) 


1 


6 to 10 


RFU 


5 


11 


Length of the following data (byte 12 to the end) 


1 


12toX 


USIM specific data - see table A.2 


21 


Table A.2: USIM Specific Data 


Byte(s) 


Description 


Length 


12 


File characteristics (see detail 1) 




13 


Number of DFs which are a direct child of the current 
directory 




14 


Number of EFs which are a direct child of the current 
directory 




15 


Number of PINs, UNBLOCK PINs and administrative codes 




16 


Application power consumption (see chapter C.2) 




17 


PIN status (see detail 2) 




18 


UNBLOCK PIN status (see detail 2) 




19 


PIN2 status (see detail 2) 




20 


UNBLOCK PIN2 status (see detail 2) 




21 


RFU 




22-32 


Reserved for the administrative management 


< Igth < 1 1 



Bytes 1 to 20 are mandatory and shall be returned by a GSM application. Bytes 21 and following are optional and may 
not be returned by a GSM application. 

NOTE 1: Byte 33 and following are RFU. 

NOTE 2: The STATUS information of the MF, DFqsm and DPtelecom provide some identical application specific 
data, e.g. PIN status. On a multi-application card the MP should not contain any application specific data. 
Such data is obtained by MPs from the specific application directories. ME manufacturers should take 
this into account and therefore not use application specific data which may exist in the MP of a 
mono-application UICC. 

Similarly, the VERIFY PIN command should not be executed in the MF but in the relevant application 
directory (e.g. DFgsm)- 
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Detail 1 : File characteristics 



b8 b7 b6 b5 b4 b3 b2 bl 



Clock stop (see below) 

For running the authentication algorithm, 

ENVELOPE command for USIM Data Download, 

is required of at least 13/8 MHz if b2=0 

MHz if b2=l 

Clock stop (see below) 

for coding (see 3G TS 31.101 [11]) 

RFU 

b8=0: PIN enabled; b8=l : PIN disabled 



or the 
a frequency 
and 13/4 



The coding of the conditions for stopping the clock is as follows: 



Bitb1 


Bitb3 


Bitb4 


1 








1 


1 





1 





1 














1 











1 



clock stop allowed, no preferred level 
clock stop allowed, high level preferred 
clock stop allowed, low level preferred 
clock stop not allowed 
clock stop not allowed, unless at high level 
clock stop not allowed, unless at low level 



If bit bl (column 1) is coded 1, stopping the clock is allowed at high or low level. In this case columns 2 (bit b3) 
and 3 (bit b4) give information about the preferred level (high or low, respectively) at which the clock may be 
stopped. 

If bit b 1 is coded 0, the clock may be stopped only if the mandatory condition in column 2 (b3= 1 , i.e. stop at 
high level) or column 3 (b4=l, i.e. stop at low level) is fulfilled. If all 3 bits are coded 0, then the clock shall not 
be stopped. 

Detail 2: Status byte of a secret code 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



Number of false presentations remaining 
( ' ' means blocked) 
RFU 

b8=0 : secret code not initialised, 
b8=l : secret code initialised 



Table A.3: SELECT Response Information in case of an EF 



Byte(s) 


Description 


Length 


1 to 2 


File size 

(for transparent EF: the length of the body part of the EF) 
(for linear fixed or cyclic EF: record length multiplied by the 
number of records of the EF) 


2 


3-4 


File ID 


2 


5 


Type of file (see C.2) 


1 


6 


See detail 3 


1 


7 to 9 


Access conditions (see C.2) 


3 


10 


File status (see C.2) 


1 


11 


Length of the following data (byte 14 to the end) 


1 


12 


Structure of EF (see C.2) 


1 


13 


Length of a record (see detail 4) 


1 


14 and 
following 


RFU 


- 



Bytes 1-12 are mandatory and shall be returned by a USIM application. 

Byte 13 is mandatory in case of linear fixed or cyclic EFs and shall be returned by a USIM application. 
Byte 13 is optional in case of transparent EFs and may not be returned by a USIM application. 
Byte 14 and following (when defined) are optional and may not be returned by a USIM application. 



Detail 3: Byte 6 
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For transparent and linear fixed EFs this byte is RFU. For a cyclic EF all bits except bit 7 are RFU; b7=l 
indicates that the INCREASE command is allowed on the selected cyclic file. 



Detail 4: Byte 13 



For cyclic and linear fixed EFs this byte denotes the length of a record. For a transparent EF, this byte shall be 
coded '00', if this byte is sent by a USIM application. If the file is of type variable then the information returned 
is the number of records. 



A.2 Coding of telecom specific EF response data 

The following response coding applies for telecom applications and are used in the response to SELECT command 
when an EF has been selected. 

File status: 



b7 



b6 



b5 



b4 



b3 



b2 



bl 



bl=0 : deactivated; bl=l : not deactivated 

RFU 

b3=0 : not readable or updatable when deactivated 

b3=l : readable and updatable when deactivated 

RFU 



Bit b3 may be set to 1 in special circumstances when it is required that the EF can be read and updated even if the EF is 
deactivated, e.g. reading and updating the EFadn when the FDN feature is enabled, or reading and updating the EFbdn 
when the BDN feature is deactivated. 



Structure of file: 


- 


'00' transparent; 


- 


'Or linear fixed; 


- 


'02'linear variable 


- 


'03' cycUc. 


Type 


of File: 


- 


'00' RFU; 


- 


'01' MF; 


- 


'02' DF; 


- 


'04' EF. 



Coding of PINs and UNBLOCK PINs 

A PIN is coded on 8 bytes. Only (decimal) digits (0-9) shall be used, coded in CCITT T.50 [23] with bit 8 set 
to zero. The minimum number of digits is 4. If the number of digits presented by the user is less than 8 then 
the ME shall pad the presented PIN with 'FF' before sending it to the USIM. 

The coding of the UNBLOCK PINs is identical to the coding of the PINs. However, the number of (decimal) 
digits is always 8. 

Coding of Access Conditions: 

The access conditions for the commands are coded on bytes 9, 10 and 11 of the response data of the SELECT 
command. Each condition is coded on 4 bits as shown in table A.4. 
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Table A.4: Access conditions 



ALW 


'0'* 


PIN 


'1'* 


Second PIN 


'2'* 


RFU 


'3' 


ADM 


'4' 






ADM 


'E' 


NEV 


'F'* 



Entries marked "*" in the table above, are also available for use as administrative codes in addition to the ADM access 
levels '4' to 'E' (refer to subclause 7.3 ?) if required by the appropriate administrative authority. If any of these access 
conditions are used, the code returned in the Access Condition bytes in the response data shall be the code applicable to 
that particular level. 

Byte 9: 



b8 


b7 


b6 


b5 


b4 


b3 


B2 


bl 














1 


1 


1 


1 


UPDATE 












READ; SEEK 


1( 


3: 


















b8 


b7 


b6 


b5 


b4 


b3 


B2 


bl 














L 


-L 


JL 


JL 


RFU 
INCREASE 


1 


1: 


















b8 


b7 


b6 


b5 


b4 


b3 


b2 


bl 














1 


1 


1 


1 


DEACTIVATE 












ACTIVATE 



A.3 Application Related Electrical Parameters 

The power consumption of a UICC is depending upon the supply voltage class and the application it is running. The 
power consumption of the UICC is restricted to the values specified in 3G TS 31.101 [11] until an application is 
selected. An application is considered to be selected when the access condition is successfully verified. If no access 
condition is required for the application, the application is considered to be selected when an application related 
command is executed within the selected application. Selecting the application and performing a STATUS command is 
not an execution of an application command. 

The ME retrieves the application power consumption information by selecting the application and performing a 
STATUS command. The power consumption parameters are returned by the card in the response to the STATUS 
command at a DP level in the application. In case of a multiapplication UICC, where the application selection according 
to ISO/IEC 7816-5 [21] is used, the application power consumption is to be indicated in the information elements of the 
application identifier stored in EFqir as defined in ISO/IEC 7816-4 [20]. 

If no power consumption indication is available in the card, the ME shall assume the application power consumption as 
specified in 3GTS 31.101 [11]. 
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Table A.5: Power Consumption during the Application Session 



Symbol 


Voltage 
Class 


Maximum 


Unit 


Remark 


Ice 


A 


60 


mA 




Ice 


A 


10 


mA 


GSM Application 


ice 


B 


50 


mA 




lee 


B 


6 


mA 


GSM Application 


ice 


C 


20 


mA 




lee 


C 


4 


mA 


GSM Application 


ice 


D 


RFU 


mA 




Ice 


E 


RFU 


mA 
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Annex B (normative): 
Image Coding Schemes 



The following image coding schemes are applicable to rectangular raster images. Raster image points are assumed to be 
of square shape. They are numbered sequentially from 1 onwards, starting at the upper left corner, proceeding line by 
line downwards, each line in turn proceeding from left to right, and ending at the image's lower right corner. 

The following example illustrates the numbering scheme for raster image points by showing how the corner points are 
numbered, assuming an image length of x points and an image height of y points. 




B.1 Basic Image Coding Scheme 

This coding scheme applies to rectangular raster images made up of raster points that are either set or not set. This 
coding scheme does not support any notion of colour. Image data are coded as follows: 



Byte(s) 


Description 


Length 


1 


image width = X 


1 


2 


image height = Y 


1 


3 to K+2 


image body 


K 



Coding of image body: 

The status of each raster image point is coded in one bit, to indicate whether the point is set (status = 1) or not set 

(status = 0). 

Byte 1: 



hi b6 b5 b4 b3 b2 bl 



status of 

status of 

status of 

status of 

status of 

status of 

status of 

status of 



raster point 8 
raster point 7 
raster point 6 
raster point 5 
raster point 4 
raster point 3 
raster point 2 
raster point 1 



Byte 2: 



b7 b6 b5 b4 bS b2 bl 



status of 

status of 

status of 

status of 

status of 

status of 

status of 

status of 



raster point 16 
raster point 15 
raster point 14 
raster point 13 
raster point 12 
raster point 11 
raster point 10 
raster point 9 



etc. 



Unused bits shall be set to 1 
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B.2 Colour Image Coding Scheme 

This coding scheme appHes to coloured rectangular raster images. Raster image point colours are defined as references 
into a colour look-up table (CLUT), which contains a subset of the red-green-blue colour space. The CLUT in turn is 
located in the same transparent file as the image instance data themselves, at an offset defined within the image instance 
data. 

Image data are coded as follows: 



Byte(s) 


Description 


Length 


1 


Image width = X 


1 


2 


Image height = Y 


1 


3 


Bits per raster image point = B 


1 


4 


Number of CLUT entries = C 


1 


5 to 6 


Location of CLUT (Colour Look-up Table) 


2 


7 to K+6 


Image body 


K 



Bits per raster image point: 
Contents: 

the number B of bits used to encode references into the CLUT, thus defining a raster image point's colour. B 

shall have a value between 1 and 8. 
Coding: 

binary. 

Number of entries in CLUT: 
Contents: 

the number C of entries in the CLUT which may be referenced from inside the image body. CLUT entries are 

numbered from to C-L C shall have a value between 1 and 2**B. 
Coding: 

binary. The value shall be interpreted as 256. 

Location of CLUT: 
Contents: 

this item specifies where the CLUT for this image instance may be found. The CLUT is always located in the 

same transparent file as the image instance data themselves, at an offset determined by these two bytes. 
Coding: 

Byte 1: high byte of offset into Image Instance File. 

Byte 2: low byte of offset into Image Instance File. 

Image body: 
Coding: 

each raster image point uses B bits to reference one of the C CLUT entries for this image instance. The 
CLUT entry being thus referenced yields the raster image point's colour.The image body is arrayed as for the 
Basic Colour Image Coding Scheme, that is, starting with the highest bit of the first raster image point's 
colour information. 



Byte 1: 



b7 b6 b5 b4 b3 b2 bl 



. . . etc 

. . . etc 

. . . etc 

. . . etc 

. . . etc 

Bit B-2 of raster point 1 CLUT reference 

Bit B-1 of raster point 1 CLUT reference 

Bit B (MSB) of raster point 1 CLUT reference 



etc. 

Unused bits shall be set to 1 . 
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The CLUT (Colour Look-up Table) for an image instance with C colours is defined as follows: 
Contents: 

C CLUT entries defining one colour each. 

Coding: 

the C CLUT entries are arranged sequentially: 



Byte(s) of CLUT 


CLUT Entry 


1-3 


entry 






3*{C-1)+1 to3*C 


Entry C-1 



Each CLUT entry in turn comprises 3 bytes defining one colour in the red-green-blue colour space: 



Byte(s) of CLUT enty 


Intensity of Colour 


1 


Red 


2 


Green 


3 


Blue 



A value of 'FF' means maximum intensity, so the definition 'FF' '00' 00' stands for fully saturated red. 

NOTE 1 : Two or more image instances located in the same file can share a single CLUT. 

NOTE 2: Most MEs capable of displaying colour images are likely to support at least a basic palette of red, green, 
blue and white. 
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Annex C (normative): 
Management of Sequence Numbers 

For efficiency reasons, it is taken into account that authentication vectors may be generated in batches (such that all 
authentication vectors in one batch are sent to the same SNA'LR). 

In its binary representation, the sequence number consists of two concatenated parts SQN = SEQ II IND. SEQ is the 
batch number, and IND is an index numbering the authentication vectors within one batch. IND represents the least 
significant bits of SQN. If the concept of batches is not supported then the parameter IND is not used and SQN = SEQ. 

The USIM keeps track internally of an ordered list of the b highest batch number values it has accepted. In addition, for 
each batch number SEQ in the list, the USIM stores internally the highest IND value IND(SEQ) it has accepted 
associated with that batch number. Let SEQio denote the lowest and SEQms denote the highest batch number in the list. 



C.1 Acceptance rule 



When a user authentication request arrives, the USIM checks whether the sequence number is acceptable. The sequence 
number SQN = SEQ II IND is accepted by the USIM if and only if a) and either b) or c) hold: 

a) SEQ- SEQms < A; 

b) SEQ is in the list and IND > IND(SEQ) ; 

c) SEQ is not in the list and SEQ > SEQio ■ 

NOTE: The purpose of condition (i) is to protect against wrap around of the counter in the USIM. 

The USIM shall also be able to put a limit L on the difference between SEQms and an accepted batch number SEQ. If 
such a limit is applied then, in addition to the above conditions, the sequence number shall only be accepted by the 
\}S\U if SEQms - SEQ < L. 

NOTE: This allows for a memory-efficient storage of batch numbers: With the exception of SEQms , the batch 

numbers in the list need not be stored in full length, if those entries in the list which would cause the limit 
L to be exceeded are removed from the list after a new sequence number has been accepted. 



C.2 List update 



After a sequence number SQN = SEQ II IND received in a user authentication request has been accepted by the USIM, 
the USIM proceeds as follows: 

a) Case 1 : the batch number SEQ is not in the list. 

Then the list entry corresponding to SEQio is deleted, SEQ is included in the list, IND(SEQ) is set to IND and 
SEQio and SEQms are updated; 

b) Case 2: the batch number SEQ is in the list. 

Then IND(SEQ) is set to IND. If a sequence number received in a user authentication request is rejected the list 
remains unaltered. 

A USIM shall support a list size of at least xx entries (FFS). 
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Annex D (informative): 
Tags defined in 31 .1 02 



Tag 


Name of Data Element 


Usage 


'D8' 


Indicator for type 1 EFs (amount of records equal to master EF) 


Phone Book Reference File (EFrbr) 


'D9' 


Indicator for type 2 EFs (EFs linked via the index administration file) 


Phone Book Reference File (EFrbr) 


'DA' 


Indicator for type 3 EFs (EFs addressed inside a TLV object) 
The following are encapsulated under 'XZ': 

'CO' EFadn data object 

'C1' EFiAP data object 

'C2' EFecti data object 

'C3' EFsNE data object 

'C4' EFanr data object 

'C5' EFpBc data object 

'C6' EFgrp data object 

'C7' EFaas data object 

'C8' EFgas data object 

'C9' EFuiD data object 


Phone Book Reference File (EFrbr) 


'DC 


Synchronisation failure 


Response to AUTHENTICATE 


'DB' 


Successful UMTS authentication 


Response to AUTHENTICATE 
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Annex E (informative): 

Suggested contents of the EFs at pre-personalization 

If EFs have an unassigned value, it may not be clear from the main text what this value should be. This annex suggests 
values in these cases. 



File Identification 


Description 


Value 


'2F E2' 


ICC identification 


operator dependant 


'6F 05' 


Language indication 


'FF' 


'6F 07' 


IMSI 


operator dependant 


'6F 20' 


Ciphering l<ey Kc 


'FF...FF07' 


'6F 30' 


PLMN selector 


'FF...FF' 


'6F31' 


HPLMN searcli period 


'FF' 


'6F 37' 


ACIVI maximum value 


'000000' (see note 1) 


'6F 38' 


USIM service table 


operator dependant 


'6F 39' 


Accumulated call meter 


'000000' 


'6F 3E' 


Group identifier level 1 


operator dependant 


'6F 3F' 


Group identifier level 2 


operator dependant 


'6F41' 


PUCT 


'FFFFFFOOOC 


'6F 45' 


CBMI 


'FF...FF' 


'6F 46' 


Service provider name 


'FF...FF' 


'6F 48' 


CBMID 


'FF...FF' 


'6F 49' 


Service Dialling Numbers 


'FF...FF' 


'6F 74' 


BCCH 


'FF...FF' 


'6F 78' 


Access control class 


operator dependant 


'6F 7B' 


Forbidden PLIVINs 


'FF...FF' 


■6F7E 


Location information 


'FFFFFFFF xxFxxx 0000 FF 01' 
(see note 2) 


'6F AD' 


Administrative data 


operator dependant 


'6F AE' 


Application profile identification 


see 10.3.16 


'4F XX' 


Abbreviated dialling numbers 


'FF...FF' 


'6F 3B' 


Fixed dialling numbers 


'FF...FF' 


'6F 3C' 


Short messages 


'OOFF...FF' 


'6F 3D' 


Capability configuration parameters 


'FF...FF' 


'6F 40' 


MSISDN storage 


'FF...FF' 


'6F 42' 


SMS parameters 


'FF...FF' 


'6F 43' 


SIVIS status 


'FF...FF' 


'6F 47' 


Short message status reports 


'OOFF...FF' 


'4F XX' 


Extension 1 


'FF...FF' 


'6F 4B' 


Extension 2 


'FF...FF' 


'6F 4C' 


Extension 3 


'FF...FF' 


'6F 52' 


GPRS Ciphering key KcGPRS 


'FF...FF07' 


'6F 53' 


GPRS Location Information 


'FFFFFFFF FFFFFF xxFxxx 0000 FF 01 ' 


'6F 54' 


SetUpMenu Elements 


operator dependent 


'4F 20' 


Image data 


'OOFF...FF' 


'4F 30' 


SoLSA Access Indicator) 


'OOFF...FF' 


'4F31' 


SoLSA LSA List 


'FF...FF' 



NOTE 1 : The value '000000' means that ACMmax is not valid, i.e. there is no restriction on the ACM. When 

assigning a value to ACMmax, care should be taken not to use values too close to the maximum possible 
value 'FFFFFF', because the INCREASE command does not update EFacm if the units to be added would 
exceed 'FFFFFF'. This could affect the call termination procedure of the Advice of Charge function. 

NOTE 2: xxFxxx stands for any valid MCC and MNC, coded according to 3G TS 24.008 [9]. 
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Annex F (informative): 

Examples of coding of LSA Descriptor files for SoLSA 

The length of all the records is determined by the LSA descriptor containing the largest number of bytes. Combinations 
containing different numbers of LSA IDs, LAC+ CI and CI or LAC can therefore be done. Various examples are show. 
Due to the OTA management of the records it is recommended that the record length is maximum 100 bytes in order to 
leave room for command descriptor and signature information in the SMS. 

This first example contains two LSAs, one described by two LSA IDs and another described by three Cell IDs, giving a 
record length of 8 bytes. 



1^' record: 



LSA descriptor 
type = LSA ID 
and number = 2 
(1 byte) 



LSA ID (3 bytes) 



LSA ID (3 bytes) 



Identifier (1 byte) 



2"" record: 



LSA descriptor 
type = CI and 
number = 3 
(1 byte) 


CI (2 bytes) 


CI (2 bytes) 


CI (2 bytes) 


Identifier (1 byte) 



The second example contains two LSAs, one described by one LSA ID and one described by two Cell Ids, giving a 
record length of 6 bytes. 



1^' record: 



LSA descriptor 
type = LSA ID 
and number = 1 
(1 byte) 


LSA ID (3 bytes) 


'FP 


Identifier (1 byte) 



2"^* record: 



LSA descriptor 
type = CI and 
number = 2 
(1 byte) 


CI (2 bytes) 


CI (2 bytes) 


Identifier (1 byte) 
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Annex G (informative): 
Phonebook Example 



The phonebook has more than 254 entries. Additional number (3 additional numbers) information and second name 
information can be added to each ADN entry. In addition each entry has a 2 byte Unique ID (UID) attached to it. The 
phonebook also contains two files that are shared EFbxti and EFpAs- These files are addressed from inside a file. EFexti 
is addressed via EFadn, EFadni and EFpAs is addressed via EFpBc, EFpBci- The phonebook supports two levels of 
grouping and hidden entries in EFpBc. 

Two records are needed in the reference file PBR '4F30' for supporting more than 254 entries. The reference file PBR 
'4F30' record structure is as shown in table Ix. The structure of the DFphonebook for Case 1 is shown in table ly. 

Table G.I : Structure of EFs inside DFphonebook 



DF 



PHONEBOOK 

5F3A' 



EFpBR 
'4F30' 



E^EXTl 

' 4F4A' 



EFpfts 
' 4F4B' 



EFftDN 

'4F3A' 



EF^oNi 
'4F3B' 



EFsNE 
'4F19' 



EFsHEl 

'4F1A' 



EFpBc 
'4F09' 



EFpBci 
MFOA' 



EFqio 
'4F21' 



EFuiDi 
'4F22' 



EF^NRA 

'4F11' 



'4F12 ' 



EFqpp 
'4F23' 



EFgRpi 
'4F24 ' 



EFftfjRB 
'4F13' 



EF^NRBl 

'4F14' 



EFftNRC 
'4F15' 



EF^NRCi 
'4F16' 



The content of a phonebook entry in the range from 1-508 is described in table Id and le. 

Table G.2: Contents of EFrbr 



Rec 1 iTag'XX'l L='12' |Tag'XO'| L='02' | '4F3A' |Tag'X6'| L='02' | '4F09' |Tag'X4'| L='02' | '4F11' |Tag'X4'| U'02' | '4F13' | 




Tag'X4' L='02' '4F15' Tag'XS' L='02' '4F19' Tag'X9' L='02' '4F21' Tag'XZ' L='08' Tag'Xr L='02' '4F4A' 




|Tag'X8'| L='02' | '4F4B' | 'FF' | 




Rec 2 ITag'XX'l L='12' |Tag'XO'| L='02' | '4F3B' |Tag'X6'| L='02' | '4F0A' |Tag'X4'| L='02' | '4F12' |Tag'X4'| L='02' | '4F14' | 




|Tag'X4'| L='02' | '4F16' |Tag'X3'| U'02' | '4F1A' |Tag'X9'| L='02' | '4F22' |Tag'XZ'| L='08' |Tag'X1'| U'02' | '4F4A' | 




|Tag'X8'| L='02' | '4F4B' | 'FF' | 
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Table G.3: Structure of the 254 first entries in the phonebook 



ADN 
'4F3A' 


PBC 
■4F09' 


GRP 
'4F23' 


ANR 
'4F11' 


ANR 
■4F13' 


ANR 
'4F15' 


SNE 
'4F19' 


UID 
'4F21' 


EXT1 
■4F4A' 


PAS 

■4F4B' 


Rec 1 


ADN 
Cont(1- 
(X+13)) 


EXT1 
Rec '02' 


Hidden 

AID rec 

N°3 


Rec n °1 

Recn°3 

'00' 


ANR1 
Recn°1 


ANR2 
Recn°2 


ANR3 
Recn°3 


Second 
Name 
Alpha 
String 


UID 


Rec '02' 


Record 
numbers 

as defined 
in 

PBC/ANR 


Rec2 


ADN 
Cont(1- 
(X+13)) 


EXT1 
Rec '2A' 


Not 
Hidden 


Recn°2 
Rec n °1 
Recn°3 


ANR1 
Recn°1 


ANR2 
Recn°2 


ANR3 
Recn°3 


Second 
Name 
Alpha 
String 


UID 


Rec '2A* 


Record 
numbers 

as defined 
in 

PBC/ANR 


Rec 3 
































































































Rec 254 

























Table G.4: Structure of phone book entries 255-508 (Rec 1-254) 



ADN 
■4F3B' 


PBC 
'4F0A' 


GRP 

■4F24' 


ANR 
'4F12' 


ANR 
'4F14' 


ANR 
'4F16' 


SNE 
'4F1A' 


UID 
'4F22' 


EXT1 
■4F4A' 


PAS 

■4F4B' 


Rec 1 


ADN 
Cont(1- 
(X+13)) 


EXT1 
Rec '02' 


Hidden 

AID 
Recn°3 


Rec n °1 

Recn°3 

'00' 


ANR1 
Recn°2 


ANR2 
Recn°2 


ANR3 
Recn°3 


Second 
Name 
Alpha 
String 


UID 


Rec '02' 


Record 
numbers 

as defined 
in 

PBC/ANR 


Rec 2 


ADN 
Cont(1- 
(X+13)) 


EXT1 
Rec '2A' 


Not 
Hidden 


Recn°2 
Rec n °1 
Recn°3 


ANR1 
Recn°2 


ANR2 
Recn°2 


ANR3 
Recn°3 


Second 
Name 
Alpha 
String 


UID 


Rec '2A* 


Record 
numbers 

as defined 
in 

PBC/ANR 


Rec 3 
































































































Rec 254 
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Annex H (informative): 

EF changes via Data Download or USAT applications 

This annex defines if changing the content of an EF by the network (e.g. by sending an SMS), or by a USAT 
Application, is advisable. Updating of certain EFs "over the air" such as EFacc could result in unpredictable behaviour 
of the UE; these are marked "Caution" in the table below. Certain EFs are marked "No"; under no circumstances should 
"over the air" changes of these EFs be considered. 



File identification 


Description 


Change advised 


'2F 05' 


Extended Language preference 


Yes 


'2F E2' 


ICC identification 


No 


'4F 20' 


Image data 


Yes 


'4F XX' 


Image Instance data Files 


Yes 


'6F 05' 


Language preference 


Yes 


'6F 07' 


IMSI 


Caution (Note 1 ) 


'6F 20' 


Ciphering key Kc 


No 


'6F 2C' 


De-personalization Control Keys 


Caution 


'6F 30' 


PLMN selector 


Caution 


'6F31' 


HPLMN search period 


Caution 


'6F 32' 


Co-operative network 


Caution 


'6F 37' 


ACM maximum value 


Yes 


'6F 38' 


SIM service table 


Caution 


'6F 39' 


Accumulated call meter 


Yes 


'6F 3A' 


Abbreviated dialling numbers 


Yes 


'6F 3B' 


Fixed dialling numbers 


Yes 


'6F 3C' 


Short messages 


Yes 


'6F3D' 


Capability configuration parameters 


Yes 


'6F 3E' 


Group identifier level 1 


Yes 


'6F 3F' 


Group identifier level 2 


Yes 


'6F 40' 


MSISDN storage 


Yes 


'6F41' 


PUCT 


Yes 


'6F 42' 


SMS parameters 


Yes 


'6F 43' 


SMS status 


Yes 


'6F 44' 


Last number dialled 


Yes 


'6F 45' 


CBMI 


Caution 


'6F 46' 


Service provider name 


Yes 


'6F 47' 


Short message status reports 


Yes 


'6F 48' 


CBMID 


Yes 


'6F 49' 


Service Dialling Numbers 


Yes 


'6F 4A' 


Extension 1 


Yes 


'6F 4B' 


Extension 2 


Yes 


'6F 4C' 


Extension 3 


Yes 


'6F4D' 


Barred dialling numbers 


Yes 


'6F 4E' 


Extension 4 


Yes 


'6F 50' 


CBMIR 


Yes 


'6F51' 


Network's indication of alerting 


Caution 


'6F 52' 


GPRS Ciphering key KcGPRS 


No 


'6F 53' 


GPRS Location Information 


Caution 


'6F 54' 


SetUpMenu Elements 


Yes 


'6F 74' 


BCCH 


No 


'6F 78' 


Access control class 


Caution 


'6F 7B' 


Forbidden PLMNs 


Caution 


'6F 7E' 


Location information 


No (Note 1 ) 


'6FAD' 


Administrative data 


Caution 


'6FAE' 


Phase identification 


Caution 


'6FB1' 


Voice Group Call Service 


Yes 


'6F B2' 


Voice Group Call Service Status 


Yes 


'6F B3' 


Voice Broadcast Service 


Yes 


'6F B4' 


Voice Broadcast Service Status 


Yes 


'6F B5' 


Enhanced Multi Level Pre-emption and Priority 


Yes 


'6F B6' 


Automatic Answer for eMLPP Service 


Yes 


'6F B7' 


Emergency Call Codes 


Caution 


N0TE1: If EFiMsi is changed, the UICC should issue REFRESH as defined in TS 31.111 and update 
EFloci accordingly. 
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